How can i leave a packet to continue the iptables ruleset checking?

How can i leave a packet to continue the iptables ruleset checking?

[ilninno]

Hello! I have some problems with netfilter_queue:

I created a queue and registered my c program, when a packet matchs
with the iptables rules my code get the event. i usually return
NF_ACCEPT and NF_DROP, but sometimes i need to leave the packet to
continue with iptables rules checking, i tried with:

1- Using NF_QUEUE: WIth this option the packet enter again in iptables
rules (from rule 1 to NFQUEUE rule), but i only want to check (from
NFQUEUE rule to end).


rule:   $IPTABLES -A OUTPUT -m state --state NEW -j NFQUEUE --queue-num 0



How can i leave the packet to continue in iptables ruleset without
beginning again?  Thanks for your time.

How can i leave a packet to continue the iptables ruleset checking?

[ilninno]

Hello! I have some problems with netfilter_queue:

I created a queue and registered my c program, when a packet matchs
with the iptables rules my code get the event. i usually return
NF_ACCEPT and NF_DROP, but sometimes i need to leave the packet to
continue with iptables rules checking, i tried with:

1- Using NF_QUEUE: WIth this option the packet enter again in iptables
rules (from rule 1 to NFQUEUE rule), but i only want to check (from
NFQUEUE rule to end).


rule:   $IPTABLES -A OUTPUT -m state --state NEW -j NFQUEUE --queue-num 0



How can i leave the packet to continue in iptables ruleset without
beginning again?  Thanks for your time.


Please, someone can help me

Re: How can i leave a packet to continue the iptables ruleset checking?

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 1092 bytes --]

Hi,

Le jeudi 01 janvier 2009 à 21:55 +0100, ilninno a écrit :
> Hello! I have some problems with netfilter_queue:
> 
> I created a queue and registered my c program, when a packet matchs
> with the iptables rules my code get the event. i usually return
> NF_ACCEPT and NF_DROP, but sometimes i need to leave the packet to
> continue with iptables rules checking, i tried with:
> 
> How can i leave the packet to continue in iptables ruleset without
> beginning again?  Thanks for your time.

You really can't. The only known workaround is to send the NF_REPEAT
verdict and mark the packet. The mark can then be used to "jump" to the
correct rule.

This is not really nice but it works.

I've recently cooked a patch for snort-inline using this method:
http://sourceforge.net/mailarchive/forum.php?thread_name=1228209364-7798-1-git-send-email-eric%40inl.fr&forum_name=snort-inline-users

The method seems to work quiet well but it may not be suitable for more
complex cases.

BR,
-- 
Eric Leblond <eric@inl.fr>
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: How can i leave a packet to continue the iptables ruleset checking?

[Patrick McHardy]

ilninno wrote:
> Hello! I have some problems with netfilter_queue:
> 
> I created a queue and registered my c program, when a packet matchs
> with the iptables rules my code get the event. i usually return
> NF_ACCEPT and NF_DROP, but sometimes i need to leave the packet to
> continue with iptables rules checking, i tried with:
> 
> 1- Using NF_QUEUE: WIth this option the packet enter again in iptables
> rules (from rule 1 to NFQUEUE rule), but i only want to check (from
> NFQUEUE rule to end).
> 
> 
> rule:   $IPTABLES -A OUTPUT -m state --state NEW -j NFQUEUE --queue-num 0
> 
> 
> 
> How can i leave the packet to continue in iptables ruleset without
> beginning again?  Thanks for your time.

You can use NF_REPEAT to enter the same chain again and mark
the packet to skip the first rules or jump to a seperate chain.