On Fri, Jul 05, 2002 at 09:54:04AM +1000, George Vieira wrote:
> So why are you allowing any other device being allowed, please tell me your
> not running PPPoE for adsl or something.. this means your network is open
> then.....

No I am not using PPPoE. I have a plain normal ethernet connection with
an static IP.

What would you use instead of '! eth0' ?

NOTE: I know that my network is not open. It's very easy to verify,
starting with pinging myself from outside.

Christophe


> 
> thanks,
> George Vieira
> Systems Manager
> Citadel Computer Systems P/L
> http://www.citadelcomputer.com.au
> 
> 
> 
> -----Original Message-----
> From: christophe barbé [mailto:christophe.barbe.ml@online.fr]
> Sent: Friday, 05 July 2002 9:47 AM
> To: netfilter@lists.samba.org
> Subject: Re: simple rules and unexpected traffic
> 
> 
> On Fri, Jul 05, 2002 at 09:44:36AM +1000, George Vieira wrote:
> > Have you got any packet counts for the DROPped rules??
> 
> no.
> 
> > I'm still a bit stumped on the
> > 
> > -A block -i ! eth0 -m state --state NEW -j ACCEPT 
> > 
> > as what other devices do you have???
> 
> I have only eth0 and lo.
> 
> Christophe
> 
> 
> > 
> > thanks,
> > George Vieira
> > Systems Manager
> > Citadel Computer Systems P/L
> > http://www.citadelcomputer.com.au
> > 
> > 
> > 
> > -----Original Message-----
> > From: christophe barbé [mailto:christophe.barbe.ml@online.fr]
> > Sent: Friday, 05 July 2002 8:57 AM
> > To: netfilter@lists.samba.org
> > Subject: Re: simple rules and unexpected traffic
> > 
> > 
> > On Fri, Jul 05, 2002 at 12:54:36AM +0200, Jan Humme wrote:
> > > On Friday 05 July 2002 00:45, christophe barbé wrote:
> > > > On Fri, Jul 05, 2002 at 08:35:53AM +1000, George Vieira wrote:
> > > > > Yes I've found that some user space programs can see stuff before
> > > > > iptables.. tcpdump too I think...
> > > >
> > > > Yes it sounds logical for tcpdump or tools like that (which pass the
> > > > interface in promiscuisious mode) to see everything. I was not
> expecting
> > > > the same from a unprivileged app like gkrellm.
> > > > It is stil unclear for me what is the data processing path.
> > > >
> > > > Has someone a clear picture of the packets path ?
> > > 
> > > It is no problem to open a socket and receive a copy of all raw packets 
> > > before they get to the kernel iptables modules. See "man 7 packet" for 
> > > details.
> > > 
> > > I believe this is how tcpdump does it too.
> > 
> > Ok it sounds logical.
> > Now the question is what is dropping these packets ? Apparently not
> > rp_filter, and not netfilter because I see no log for it.
> > 
> > Christophe
> > 
> > > 
> > > Jan Humme.
> > 
> > -- 
> > Christophe Barbé <christophe.barbe@ufies.org>
> > GnuPG FingerPrint: E0F6 FADF 2A5C F072 6AF8  F67A 8F45 2F1E D72C B41E
> > 
> > Imagination is more important than knowledge.
> >    Albert Einstein, On Science
> 
> -- 
> Christophe Barbé <christophe.barbe@ufies.org>
> GnuPG FingerPrint: E0F6 FADF 2A5C F072 6AF8  F67A 8F45 2F1E D72C B41E
> 
> L'experience, c'est une connerie par jour mais jamais la même.
> 

-- 
Christophe Barbé <christophe.barbe@ufies.org>
GnuPG FingerPrint: E0F6 FADF 2A5C F072 6AF8  F67A 8F45 2F1E D72C B41E

Dogs believe they are human. Cats believe they are God.