Re: conntrack GRE behaves differently in 3.17 / 3.18

[Eliezer Croitoru <eliezer@ngtech.co.il>]

Hey,

The way iptables rules are working is "first match" so in the case of an 
ACCEPT rule it will only be ACCEPTED if it matches the rule else it will 
try the next rule.
Always there was a need to add two rules to match an ESTABLISHED,RELATED.
1 - For the NEW state
2 - For the ESTABLISHED,RELATED

As long these rules are there with an ACCEPT target it will always be fine.

The main consideration is what will be faster to match from the two?
 From what I have seen until now FW rules usually have an 
ESTABLISHED,RELATED rule first and then the other NEW rules.

If it's right to "hijack" the thread for this particular case:
Which is better to be first?

Eliezer

On 22/01/2015 12:10, Mart Frauenlob wrote:
> Hello,
>
> the way I understand the change is:
> you need to add an according iptables rule for the first state NEW
> packet, which will then load the according conntrack helper
> automatically. So further packets are classified as ESTABLISHED or RELATED.
> There is no mechanism of unloading a module once it has been loaded afaik.