unclean rule

unclean rule

[Luis Miguel Cruz]

Is safe to use unclean module?

--
Luis Miguel Cruz

Re: unclean rule

[Raileanu Grigore]

On Fri, 11 Jun 2004 13:07:37 +0200
Luis Miguel Cruz <luismi@b2bi.es> wrote:

> Is safe to use unclean module?
> 
> --
> Luis Miguel Cruz
> 
> 

Yes, you can discard without any problems unclean packets.

-- 
Best regards,
Raileanu Grigore
mail: grisha at unixro dot net
phone: +40 742759147

Re: unclean rule

[Luis Miguel Cruz]

I asked it because I remember that in the past this module have a lot of 
problems, I like to know if those problems are solved now.

I have a problem with a client, he can´t do a ftp to our servers :P
The traffic match unclean rule:

iptables -A SEGURIDAD -m unclean -j DROP

All traffic must across SEGURIDAD chain, I only have problems with ftp 
service and this client, the rest of the services runs perfectly for him.

What can be wrong? the client´s adsl router? :P


Raileanu Grigore wrote:

> On Fri, 11 Jun 2004 13:07:37 +0200
> Luis Miguel Cruz <luismi@b2bi.es> wrote:
> 
> 
>>Is safe to use unclean module?
>>
>>--
>>Luis Miguel Cruz
>>
>>
> 
> 
> Yes, you can discard without any problems unclean packets.
> 

Re: unclean rule

[Raileanu Grigore]

On Fri, 11 Jun 2004 13:35:42 +0200
Luis Miguel Cruz <luismi@b2bi.es> wrote:

> I asked it because I remember that in the past this module have a lot of 
> problems, I like to know if those problems are solved now.
> 
> I have a problem with a client, he can´t do a ftp to our servers :P
> The traffic match unclean rule:
> 
> iptables -A SEGURIDAD -m unclean -j DROP
> 
> All traffic must across SEGURIDAD chain, I only have problems with ftp 
> service and this client, the rest of the services runs perfectly for him.
> 
> What can be wrong? the client´s adsl router? :P
> 
> 
> Raileanu Grigore wrote:
> 
> > On Fri, 11 Jun 2004 13:07:37 +0200
> > Luis Miguel Cruz <luismi@b2bi.es> wrote:
> > 
> > 
> >>Is safe to use unclean module?
> >>
> >>--
> >>Luis Miguel Cruz
> >>
> >>
> > 
> > 
> > Yes, you can discard without any problems unclean packets.
> > 
> 
> 

Try to add in your firewall logging rules, and you can see, which packets are rejected by firewall.

-- 
Best regards,
Raileanu Grigore
mail: grisha at unixro dot net
phone: +40 742759147

Re: unclean rule

[Luis Miguel Cruz]

Uh? What? yes or no? :)

Raileanu Grigore wrote:

 > Yes, you can discard without any problems unclean packets.
 >

Predrag Petrovic wrote:

> No
> 
> -----Original Message-----
> From: netfilter-admin@lists.netfilter.org
> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Luis Miguel Cruz
> Sent: Friday, June 11, 2004 1:08 PM
> To: netfilter@lists.netfilter.org
> Subject: unclean rule
> 
> Is safe to use unclean module?
> 
> --
> Luis Miguel Cruz
> 

Re: unclean rule

[Luis Miguel Cruz]

Yes, I have it.
But  I want to know why is the reason of the unclean module to drop ftp 
packets for this client :P

My rules are:
$IPT -A SEGURIDAD -m unclean -j LOG --log-prefix "Paquete Unclean: " 
--log-ip-options --log-tcp-options --log-tcp-sequence
$IPT -A SEGURIDAD -m unclean -j DROP


Raileanu Grigore wrote:

> On Fri, 11 Jun 2004 13:35:42 +0200
> Luis Miguel Cruz <luismi@b2bi.es> wrote:
> 
> 
>>I asked it because I remember that in the past this module have a lot of 
>>problems, I like to know if those problems are solved now.
>>
>>I have a problem with a client, he can´t do a ftp to our servers :P
>>The traffic match unclean rule:
>>
>>iptables -A SEGURIDAD -m unclean -j DROP
>>
>>All traffic must across SEGURIDAD chain, I only have problems with ftp 
>>service and this client, the rest of the services runs perfectly for him.
>>
>>What can be wrong? the client´s adsl router? :P
>>
>>
>>Raileanu Grigore wrote:
>>
>>
>>>On Fri, 11 Jun 2004 13:07:37 +0200
>>>Luis Miguel Cruz <luismi@b2bi.es> wrote:
>>>
>>>
>>>
>>>>Is safe to use unclean module?
>>>>
>>>>--
>>>>Luis Miguel Cruz
>>>>
>>>>
>>>
>>>
>>>Yes, you can discard without any problems unclean packets.
>>>
>>
>>
> 
> Try to add in your firewall logging rules, and you can see, which packets are rejected by firewall.
>