* avoid conntrack
@ 2006-02-20 13:30 Clist
2006-02-23 0:21 ` Philip Craig
2006-03-03 14:48 ` Steven M Campbell
0 siblings, 2 replies; 3+ messages in thread
From: Clist @ 2006-02-20 13:30 UTC (permalink / raw)
To: netfilter
Hi list,
It is needed to do '-j NOTRACK' in order to avoid conntracking for some
packets, or i can simply DROP packets on the raw table so they do not reach
other netfilter tables and so it is not conntracking for those packets..?
Now and simply do
*raw
-A PREROUTING <some criteria> -j DROP
do i need to do
-A PREROUTING <some criteria> -j NOTRACK
-A PREROUTING <some criteria> -j DROP
Thanks...
--
---------------------------------------------
Clister UAH
---------------------------------------------
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: avoid conntrack
2006-02-20 13:30 avoid conntrack Clist
@ 2006-02-23 0:21 ` Philip Craig
2006-03-03 14:48 ` Steven M Campbell
1 sibling, 0 replies; 3+ messages in thread
From: Philip Craig @ 2006-02-23 0:21 UTC (permalink / raw)
To: clist; +Cc: netfilter
On 02/20/2006 11:30 PM, Clist wrote:
> It is needed to do '-j NOTRACK' in order to avoid conntracking for some
> packets, or i can simply DROP packets on the raw table so they do not reach
> other netfilter tables and so it is not conntracking for those packets..?
Just drop them. The drop occurs immediately.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: avoid conntrack
2006-02-20 13:30 avoid conntrack Clist
2006-02-23 0:21 ` Philip Craig
@ 2006-03-03 14:48 ` Steven M Campbell
1 sibling, 0 replies; 3+ messages in thread
From: Steven M Campbell @ 2006-03-03 14:48 UTC (permalink / raw)
To: clist; +Cc: netfilter
Clist wrote:
> Hi list,
>
> It is needed to do '-j NOTRACK' in order to avoid conntracking for some
> packets, or i can simply DROP packets on the raw table so they do not reach
> other netfilter tables and so it is not conntracking for those packets..?
>
>
> Now and simply do
> *raw
> -A PREROUTING <some criteria> -j DROP
>
> do i need to do
> -A PREROUTING <some criteria> -j NOTRACK
> -A PREROUTING <some criteria> -j DROP
>
> Thanks...
>
conntrack only keeps track of connections, it does absolutely nothing
to your firewall rules, it's up to you to decide what to do with the
connection states in your rules. At some point you have a rule that is
similar to --state established,related -j ACCEPT, that's where you are
allowing packets through because they are in conntrack, if you want to
eliminate some packets regardless of state then just do so before you
hit the rule.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2006-03-03 14:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-02-20 13:30 avoid conntrack Clist
2006-02-23 0:21 ` Philip Craig
2006-03-03 14:48 ` Steven M Campbell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.