new connections

new connections

[Ramoni]

People...
What do you all think about make rules for new connections only ?
Make all rules for new connections (--syn) and let the -m state --state 
ESTABLISHED care about connectuions you have allowed ?

I' ll aplly a poatch on my firewall to support the raw table, to use the 
NOTRACK targe for cionnections that I does not need to track (and ensure a 
connection response) for example:
A connection from outside to my webserver, will always come from random port 
to port 80 of my server, and the response will be from port80 to any port 
outsdie.

Whats the really need to track this ? I can make rules allowing these and just 
make connectinio tracking for connections from inside to outside that I wont 
make rules expecting the response.

Sorry for the bad english, as usually.
Ramoni

Re: new connections

[Jason Opperisano]

On Sun, 2005-02-06 at 02:20, Ramoni wrote:
> People...
> What do you all think about make rules for new connections only ?
> Make all rules for new connections (--syn) and let the -m state --state 
> ESTABLISHED care about connectuions you have allowed ?

that's exactly how i build every firewall.

> I' ll aplly a poatch on my firewall to support the raw table, to use the 
> NOTRACK targe for cionnections that I does not need to track (and ensure a 
> connection response) for example:
> A connection from outside to my webserver, will always come from random port 
> to port 80 of my server, and the response will be from port80 to any port 
> outsdie.
> 
> Whats the really need to track this ? I can make rules allowing these and just 
> make connectinio tracking for connections from inside to outside that I wont 
> make rules expecting the response.

um--the point of bypassing connection tracking with the use of NOTRACK
is that the overhead of connection tracking adds unacceptable latency to
the connection.  i have seen this used (and used it myself) for
high-load DNS servers.  since almost every DNS resolution request is one
packet request, one packet response; there is a noticeable delay between
using connection tracking over NOTRACK.  i suppose the same argument
could be made for a very high traffic web server that gets lots of
short-lived requests for tiny amounts of data.

-j

--
"I am so smart, I am so smart, s-m-r-t....I mean s-m-A-r-t."
	--The Simpsons