conntrack module question?

[Husnu Demir <hdemir@metu.edu.tr>]

[-- Attachment #1: Type: text/plain, Size: 838 bytes --]


Hi,

I am using conntrack module for a while. As suggested configuration I do add ;


-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m conntrack --ctstate INVALID -j DROP

At the top of the configuration. After that I added the drop rule as;


-A FORWARD -i eth0 -o eth1 -m set --match-set STOPALL src -j DROP

This rule is not statefull and should drop everything. I added an IP address,
174.142.179.235 a SPAMMER, to stop its communication. But it did no stop. As far
as I know in TCP connection the packets is not in ESTABLISHED state but could be
RELATED :(.

I wrote "drop everything from STOPALL list", but the connection is not dropped. If
I wrote the the DROP statement above the 1st rule, it will drop all the
connection. What is wrong? I do not want to write DROP statement to the top?


Thanks.



[-- Attachment #2: hdemir.vcf --]
[-- Type: text/x-vcard, Size: 164 bytes --]

begin:vcard
fn:Husnu Demir
n:Demir;Husnu
email;internet:hdemir@metu.edu.tr
tel;work:+903122103330
tel;fax:+903122103303
x-mozilla-html:FALSE
version:2.1
end:vcard