Re: rfc: reject use of drop in nat table

[Patrick McHardy <kaber@trash.net>]

Jozsef Kadlecsik wrote:
> On Mon, 4 Aug 2008, Patrick McHardy wrote:
> 
>> Jan Engelhardt wrote:
>>> This just happened to be within my thoughts. Comments, declinations?
>> Well, first thought is the usual fear of breaking setups.
>>
>> But I do agree that this makes sense, we've had a number
>> of "bugreports" over the years from people how tried to
>> do filtering in the nat table and didn't realize it only
>> sees the first packet of a connection.
>>
>> Not sure - anyone else with an opinion? :)
> 
> Instead of the line
> 
> +                       exit_error(OTHER_PROBLEM, "The nat table is not for filtering");
> 
> the next one would probably be little bit more user friendly:
> 
> +                       fprintf(stderr, "The nat table is not for filtering, next iptables release won't support it at all. Fix your setup.\n");
> 
> And in the next release it could be changed to 'exit_error'.

That sounds good, lets do that.