linux-iptables -j与-g参数

从发行版的手册页中,我对下面的粗体部分特别感兴趣.

-j,-跳转目标

This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate
of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet’s fate, but the counters on the
rule will be incremented.

-g,–goto链

This specifies that the processing should continue in a user specified chain. Unlike the –jump option return will not continue processing in this chain but instead in the chain that called us via –jump.

我担心我会误解-g的实际作用.

-g现在与-j有什么不同？

解决方法:

当当前链中的匹配规则指定目标RETURN时,或到达当前链的末尾时,处理将在跳到当前链的上一个链中继续进行,从仍未处理的下一个规则遍历它,即实际指定当前链为目标并触发跳转到当前链的规则下方的规则.

但是,如果跳转到当前链是通过-g(而不是通过-j)完成的,则处理不会在前一个链中继续进行,而是在之前的链中继续进行,假设跳转是通过-j完成的.如果不是这种情况(即使用了-g),那么将考虑之前的链,依此类推.换句话说,将使用-j而不是-g实际指定下一个链的最近链.

如果未找到这样的链(即,直到并包括-g指定的内置链的所有链),或者到达了内置链的末尾,或者匹配了具有目标RETURN的内置链中的规则,内置链策略指定的目标确定数据包的命运.

标签：stateful,iptables,firewall,linux
来源： https://codeday.me/bug/20191120/2040284.html