From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michele Petrazzo - Unipex Subject: Re: strange log on gateway inside [] Date: Fri, 30 Jul 2010 12:41:38 +0200 Message-ID: <4C52AC62.3090609@unipex.it> References: <4C513E0B.6040005@unipex.it> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <4C513E0B.6040005@unipex.it> Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@vger.kernel.org Jan Engelhardt wrote: Hi e thanks. >>> And the last, have you also an rfc that explain why and where >>> invalid come from? > INVALID is a CT classification. RFC don't have much to do with that. Pascal Hambourg wrote: > ICMP port unreachable is not the natural reply to an unexpected TCP > packet, so I guess it was generated by a REJECT target in the INPUT > or FORWARD chain. If the original packet was in the INVALID state > (or UNTRACKED if you used the NOTRACK target), then the ICMP error > packet is in the INVALID state instead of RELATED. A doubt. Like said, INVALID is only a CT classification of my firewall. But, since it's not a standard, how I can receive and reply (through my FORWARD chain) to an INVALID packet? Who generate/classify it like INVALID? My sender (I don't believe since it's not a standard) or my CT? Thanks, Michele