From: Eldad Zack <eldad@stoneshaft.ath.cx>
To: Tim Gardner <timg@tpi.com>
Cc: Balazs Scheidler <bazsi@balabit.hu>,
Netfilter Development Mailinglist
<netfilter-devel@lists.netfilter.org>
Subject: Re: 2.4 SNAT fails randomly
Date: Wed, 19 Nov 2003 09:46:00 +0200 (IST) [thread overview]
Message-ID: <Pine.LNX.4.58.0311190942290.31702@localhost> (raw)
In-Reply-To: <200311180835.09794.timg@tpi.com>
On Tue, 18 Nov 2003, Tim Gardner wrote:
> I've been thinking more about this scenario. When a standard distribution like
> SuSE-9.0 boots, the interfaces are IFF_UP sometime before firewall rules are
> installed. This is particularly a problem in the case of a NAT router. Is
> there any way to flush /proc/net/ip_conntrack to make sure that you get rid
> of entries that were established between the time the interfaces were brought
> up and the time the rules were installed? Removing the ip_conntrack modules
> seems kind of brute force, and does not work on kernels where ip_conntrack is
> not a module.
There is a quick and dirty way to do it - forging a RST packet to the
tuple you want to flush. I've used hping to forge such packets and
iptstate to look at the conntrack table.
There really should be another way, though.
Eldad
prev parent reply other threads:[~2003-11-19 7:46 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-11-15 18:03 2.4 SNAT fails randomly Tim Gardner
2003-11-16 9:52 ` Balazs Scheidler
2003-11-16 16:53 ` Tim Gardner
2003-11-18 15:35 ` Tim Gardner
2003-11-18 16:20 ` Balazs Scheidler
2003-11-19 7:46 ` Eldad Zack [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.58.0311190942290.31702@localhost \
--to=eldad@stoneshaft.ath.cx \
--cc=bazsi@balabit.hu \
--cc=netfilter-devel@lists.netfilter.org \
--cc=timg@tpi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.