Re: how to ignore forwarded traffic?

["Sven Köhler" <sven.koehler@gmail.com>]

Am 21.04.2014 11:38, schrieb Anton 'EvilMan' Danilov:
> Hi, Sven.
> 
> You can disable conntrack at all by removing of the module.

Assume, the firewall protecting the router is stateful (i.e., it uses
conntrack).

> Also you can disable conntrack only for specifyed connections with CT
> target (--notrack option).

I know have the following three rules:

iptables -t raw -A PREROUTING -d <router-ip> -j CT
iptables -t raw -A PREROUTING -s <router-ip> -j CT
iptables -t raw -A PREROUTING -j CT --notrack

So any traffic directed at the router or coming from the router should
be conntracked while all other traffic is not.
Note, that I don't have any rules in the OUTPUT chain of the raw table,
as it seems to me that the default (connections are conntracked) is fine.

Do the above rules seem OK to you?


Regards,
  Sven