Tracing in IPTables?

Question

iptables

Good day to ALL!

Let's say we have a raw table like this:

*raw
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
-A PREROUTING -i eth0 -s xxxx/32 -p tcp -m tcp --dport 12345 -j TRACE
-A OUTPUT -o eth0 -d xxxx /32 -p tcp -m tcp --sport 12345 -j TRACE
COMMIT

What does the "policy:2" in the "TRACE: raw:PREROUTING:policy:2" prefix mean?

Thank you.

Answer 1

https://gist.github.com/egernst/2c39c6125d916f8caa...

Note: If the matching rule number (3 for prerouting chain of raw table) is greater than the number of rules there, it means there wasn't a match for any of the rules and it is just returning to whomever called the chain.

https://stackoverflow.com/questions/41748330/how-t...

came to this question too and dit some testing: policy:5 seem to refer to the fictitious last "rule" of your chain, where the policy is considered. so loonyuni's traced chain should have 4 explicit rules in it.

In other words, policy means that policy (the default rule for the chain) worked.
And policy:2 only means that there was one rule in the chain and policy turned out to be the last and second. If there were four rules in the chain, policy:5 would appear somewhere in the log.

Answer 2

Thank you. Of course, the purpose of TRACE is not terminating, the packet leaves the table according to the policy.
Even uncomfortable that so blunted.