Re: Theoretical question: need for filter table in the POSTROUTING chain

["Gáspár Lajos" <swifty@freemail.hu>]

> How about putting a reject route in the kernel routing table?
Yeah.. that is an alternative...
But:
  - I want to REJECT any tcp sessions with tcp-reset,
  - and any other protocoll with icmp-admin-prohibited.
  - I would like to do it in iptables/netfilter.

The main question is: Why do not we have such a table in the POSTROUTING 
chain?
>
> That will very easily prevent the packets from leaving your system.
>
> Further, I think the kernel will (by default) send an ICMP packet 
> indicating that there is no route.
As I know this is true...
>
> IPTables is great, but sometimes it's better to use a different 
> technology.
>
>
>
> Grant. . . .
>
>
> P.S.  Here's a series of commands that I run on my systems.
>
> route add -net 0.0.0.0 netmask 255.0.0.0 reject
> route add -net 10.0.0.0 netmask 255.0.0.0 reject
> route add -net 169.254.0.0 netmask 255.255.0.0 reject
> route add -net 172.16.0.0 netmask 255.240.0.0 reject
> route add -net 192.0.2.0 netmask 255.255.255.0 reject
> route add -net 192.168.0.0 netmask 255.255.0.0 reject
> route add -net 198.51.100.0 netmask 255.255.255.0 reject
> route add -net 203.0.113.0 netmask 255.255.255.0 reject
>
I have similar rules in my iptables firewall script. And you can put the 
rules above in a table with the "ip route add table..." thing. And after 
that you can "call" them with "ip rule ..." rules.

Thanx for your reply! :D


Swifty