What happens when there's no custom chain to jump in a table in iptables?
I think your question is rooted in the fact that iptables-save
output does not include counters in custom chains.
Only the default chains in each table (see man 8 iptables
for which that are in each table) will have packet/byte counters saved.
All other chains in are always saved with [0:0]
values.
You may want to add the iptables-save -c
flag to include packet/traffic counters for all rules to see how packets traverse your chains and rules. That should also give an indication to where their fate is decided.
Because AFAIK the usual behaviour with a -j
target is that when the rules in the target chain have been processed and didn't result in a dispositive match , then processing returns to the original chain and the next rule(s) there will be processed. So I suspect that when a custom target is empty that is also what happens, processing will immediately continue with the next rule in the chain.