Re: iptables leaking blocked ip addresses.

[/dev/rob0 <rob0@gmx.co.uk>]

On Monday 20 June 2005 14:36, terry l. ridder wrote:
> > > > I prefer to do filtering in the filter table as $DEITY
> > > > intended. :)
> >
> > For me that is more or less a matter of faith. I hope someone who
> > knows more about it will come along and explain why your NAT use is
> > poor design.

(Sven did this, thanks again, Sven.)

> do you have anything to contribute besides sniping at the manner in
> which i run and manage my network?

I do apologise for the tone which came across. I understand and
validate your feelings: I definitely could have worded it better. But
in fact I do believe I offered some useful suggestions; do with them 
what you will.

> > > connection tracking is turned off since at one time i was
> > > using tarpit instead of just dropping the connections.
> >
> > Whatever. Without connection tracking you might as well use
> > ipchains.
>
> the tarpit howto does say to turn connection tracking off.

Ah, I did not know this. TY for the information. But that itself brings 
the whole tarpitting concept into question, in my mind. Anything which 
throws away the main benefit of iptables can't be worth the trouble.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header