Re: iptables leaking blocked ip addresses.

[Feizhou <feizhou@linuxmail.org>]

Cedric Blancher wrote:
> Le mardi 21 juin 2005 à 17:36 +0800, Feizhou a écrit :
> 
>>netfilter's conntrack module sucks in performance and at the same time 
>>is not fully stateful.
> 
> 
> The last serious paper I could read about performances comparison was
> published on pf website long ago and desmonstrated a clear advantage for
> Netfilter against pf or ipf.
> 
> 	http://www.benzedrine.cx/pf-paper.html

Yes...when NOT doing stateful. I have no arguments for netfilter's 
filtering performance. Filtering barely adds overhead for my boxes. 
Loading the conntrack module however had some painful effects...
> 
> However, at this time, Netfilter was indeed not fully stateful. But it's
> no longer the case as Netfilter now implements TCP window tracking in
> stock kernels.

Ah, sorry, I knew that this was brought up some time ago but I did not 
the end result. I take back my not fully stateful statement.
> 
> If you know good comparisons published, I wuold be happy to read them.
> 

I will try a Linux based bridge setup in place of our OpenBSD firewall 
now that we can get some equivalency in function. Or just go stateless. 
Any suggestions on what kernel version to use? A Fedora errata in case I 
install Fedora Core 3/4? Or a stock Linux kernel?