From: Patrick Turley <pturley@rocksteady.com>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] ACCEPT/DROP/REJECT in mangle?
Date: Wed, 10 Mar 2004 18:24:36 +0000 [thread overview]
Message-ID: <404F5D64.1030703@rocksteady.com> (raw)
In-Reply-To: <200403101717.57378.lists@sperling.no>
> 1a) Is it possible/recommended to ACCEPT/DROP/REJECT in mangle FORWARD?
Yes, it's possible. It's generally regarded as good firewall hygiene to
only "transform" packets in the mangle table and make ACCEPT/DROP/REJECT
decisions in the filter table - but there are definitely exceptions.
> 1b) Is it possible/recommended to MARK in filter FORWARD?
No. MARK is only valid in the mangle table.
> 2) Can i safely put SFQ on a HTB leaf?
Yes.
> 3) It appears that only packets that are not conntracked traverse the nat
> table, is this correct?
Yes, that's true. Once NAT'ing has been associated with a particular
connection, further packets associated with that connection will
automatically undergo the same transformation.
> 4) Does mangle OUTPUT happen before or after routing?
The best illustration for this on the entire net is the KPTD figure on
www.docum.org. From this picture, you can see that this happens *before*
routing.
> 5) When exactly in the packet traversal do egress shaping happen? After
> mangle
> POSTROUTING? After nat POSTROUTING?
See the same figure. Traffic control occurrs before and after firewall
traversal.
> 6) Recommendations on handling the massive number of connections created by
> P2P? When P2P classes need to stop borrowing from higher priority classes,
> the sheer number of connections appear to create some latency.
I don't have a ready answer for this.
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
prev parent reply other threads:[~2004-03-10 18:24 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-03-10 15:17 [LARTC] ACCEPT/DROP/REJECT in mangle? Erik S. Johansen
2004-03-10 18:24 ` Patrick Turley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=404F5D64.1030703@rocksteady.com \
--to=pturley@rocksteady.com \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox