* INVALID connections and SNAT
@ 2010-04-12 16:30 Igor Bogomazov
2010-04-12 16:56 ` Jan Engelhardt
0 siblings, 1 reply; 2+ messages in thread
From: Igor Bogomazov @ 2010-04-12 16:30 UTC (permalink / raw)
To: netfilter
[-- Attachment #1: Type: text/plain, Size: 558 bytes --]
Hello,
Just noticed few packets which pass SNAT in POSTROUTING without
altering their SRC. The problem has been obscured by the fact, that all
works in general, no one complain.
After I add REJECT rule for "-m state --state INVALID" connections,
unmodified (not NATed) packets have disappeared. All right now.
Why INVALID connections pass thru NAT instead of dropping them? It
seems like a security risk, when hacker can listen not-NATed packets
behind the router and learn a network topology.
--
С уважением,
Igor Bogomazov
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: INVALID connections and SNAT
2010-04-12 16:30 INVALID connections and SNAT Igor Bogomazov
@ 2010-04-12 16:56 ` Jan Engelhardt
0 siblings, 0 replies; 2+ messages in thread
From: Jan Engelhardt @ 2010-04-12 16:56 UTC (permalink / raw)
To: Igor Bogomazov; +Cc: netfilter
On Monday 2010-04-12 18:30, Igor Bogomazov wrote:
>
>Why INVALID connections pass thru NAT instead of dropping them?
They don't pass through it.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2010-04-12 16:56 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-04-12 16:30 INVALID connections and SNAT Igor Bogomazov
2010-04-12 16:56 ` Jan Engelhardt
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.