Explanation of Lokkit?

I'm trying to build my own iptables control panel for myself and
understand the iptables command in the process. I'm getting somewhere
and am comparing my results to what comes out from the "lokkit"
command. The problem I have is that I don't understand why LOKKIT puts
a chain below INPUT, FORWARD, and OUTPUT, rather than appending to
those chains. For instance, look at what I have below.

Am I to assume that in my Linux distro, lokkit isn't seeming to work
because it's not playing with the INPUT, FORWARD, and OUTPUT chains?

LOKKIT ON MEDIUM BUT SUPPORT INCOMING HTTP

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Lokkit-0-50-INPUT (0 references)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp
dpt:www flags:SYN,RST,ACK/SYN
ACCEPT all -- anywhere anywhere
REJECT tcp -- anywhere anywhere tcp
dpts:0:1023 flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp
dpt:2049 flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp
dpts:0:1023 reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp
dpt:2049 reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp
dpts:x11:6009 flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp
dpt:font-service flags:SYN,RST,ACK/SYN reject-with icmp-port-unreachable

On 23 Jul 2005 09:14:05 -0700, googlemike@hotpop.com wrote:

I think that's a sensible question. I think that the usual lokkit
arrangement has the user-defined chain as you show
(RH-Lokkit-0-50-INPUT). But what your output does not show is that is
also gives this user-defined chain as the target for the INPUT and
FORWARD chains. I don't know why that's not the case on your machine.
As shown, your RH-Lokkit... chain never has any effect I think, like
dead code. Look for a little /usr/sbin/lokkit utility that gives you
some control over lokkit. Anyway, making your own script of iptables
commands is probably more flexible and precise. I like this one

http://www.malibyte.net/iptables/scripts/fwscripts.html