Iptables vserver chain?

[TheStork]

Many of the examples around NAT scripts on this forum and in the documentation on GitHub use the chain 'VSERVER' for iptables, e.g. :

iptables -t nat -I VSERVER 3 -p tcp -m tcp -s 10.10.10.10 --dport 3389 -j DNAT --to 192.168.1.100

My understanding of iptables is still relatively basic, but I have a rough idea what e.g. the POSTROUTING, PREROUTING and OUTPUT chains are for. However, could someone please clarify where (and why) a VSERVER chain comes into play?

Thanks in advance.

 

[john9527]

VSERVER is for manual port forwards (there is also a VUPNP chain when a upnp forward is established).

You can see them on the System Log/Port Forwarding tab.

 

[TheStork]

Thanks John,

Am I being silly, or wouldn't the PREROUTING chain do something very similar for manual port forwards? What's the difference?
(I'm trying to visualise where the VSERVER 'hookpoint' would sit relative to PREROUTING, POSTROUTING, INPUT, OUTPUT, and FORWARD chains).

Apologies if I'm being slow here...

 

[ColinTaylor]

Unlike the chains you mention which are built-in, VSERVER is a user defined chain that sits in the NAT table.

The contents of this chain, as well as others like VUPNP, FUPNP and PControls, are automatically generated by the firmware depending on settings in the GUI.

The meaning of the names that ASUS chose are fairly obvious and having separate chains for different functions keeps things nice and simple, rather than having them all lumped together in one place. But you are correct in that the VSERVER chain is just hooked into the PREROUTING chain of the NAT table. You could put all of the VSERVER rules into the PREROUTING chain, it just makes it more difficult to manage.

If you issue the following command from the routers command prompt it will be a little bit easier to understand how the chains interact. (Of course, if you don't have any active forwarded ports or parental controls there won't be much to see other than a bunch of unused chains!)

iptables-save

 

[RMerlin]

PREROUTING would imply every single packet coming in would be checked against the rule, while having it in VSERVER means it will only be checked if it's actually a packet that's targeting your LAN. Therefore, more efficient.

 

[anontemp123]

TheStork's example above (which is also found in the Wiki) adds that rule as rule number 3 in the VSERVER chain. If I follow the second example here for using a rule like this with a dynamic DNS host, it will flush the complete VSERVER chain when updating the rule. Is there a way to work around this?

Also, when I add a manual port forward via the WebUI, I am given the option to enter a source IP address, so why should we manually invoke iptables to enter this rule?