From: "Gáspár Lajos" <swifty@freemail.hu>
To: Jan Engelhardt <jengelh@medozas.de>
Cc: netfilter list <netfilter@vger.kernel.org>
Subject: Re: Theoretical question: need for filter table in the POSTROUTING chain
Date: Fri, 26 Aug 2011 11:13:15 +0200 [thread overview]
Message-ID: <4E5763AB.10106@freemail.hu> (raw)
In-Reply-To: <alpine.LNX.2.01.1108260954570.6835@frira.zrqbmnf.qr>
Hi,
2011-08-26 09:56 keltezéssel, Jan Engelhardt írta:
>>
>>> How about putting a reject route in the kernel routing table?
>> Yeah.. that is an alternative...
>> But:
>> - I want to REJECT any tcp sessions with tcp-reset,
>> - and any other protocoll with icmp-admin-prohibited.
>> - I would like to do it in iptables/netfilter.
>>
>> The main question is: Why do not we have such a table in the POSTROUTING chain?
> If they did not go through nat, the packet's computed state was most
> likely INVALID or UNTRACKED to begin with. And that you can already
> filter for in FORWARD.
I do not get it...
If a packet comes from the network then it is either goes to FORWARD or
to INPUT... (You can forget INPUT for now.) And there we have nat...
If a packet comes from the local computer then it leaves out on the
OUTPUT chain... And there we have nat again...
So every packet should be tracked at the POSTROUTING chain...
Yes, I can filter at the FORWARD and the OUTPUT chain... But why can't I
at the POSTROUTING???
I do not seek alternatives... (I found them... :D) I want to know why it
is not "enabled" ???
Thanx
Swifty
next prev parent reply other threads:[~2011-08-26 9:13 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-08-25 11:40 Theoretical question: need for filter table in the POSTROUTING chain Gáspár Lajos
2011-08-25 14:51 ` Grant Taylor
2011-08-25 15:30 ` Gáspár Lajos
2011-08-26 7:56 ` Jan Engelhardt
2011-08-26 9:13 ` Gáspár Lajos [this message]
2011-08-26 9:51 ` Jan Engelhardt
2011-08-26 21:16 ` Christian Benvenuti (benve)
2011-08-26 21:45 ` Jan Engelhardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4E5763AB.10106@freemail.hu \
--to=swifty@freemail.hu \
--cc=jengelh@medozas.de \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.