Re: 2.6.20: ipt_owner match and INPUT chain

[Thomas Jarosch <thomas.jarosch@intra2net.com>]

On Thursday, 8. March 2007, Patrick McHardy wrote:
> > Thanks for clearing this up. Is this change easy to do, like it would
> > take you ten minutes or is it a more complex task?
>
> Without having looked into this in detail, I guess it should be
> in the tens of minutes range. We need this anyway for state
> synchronization since the H.323 helper manually assigns
> unregistered helpers to its children.

Do expectations always need an associated conntrack entry
or could they be added as orphans? I can imagine it will be
quite difficult for the shell script to find
the correct client<->socks server conntrack.

> Great. Just for reference, this is the patch I was talking about:
>
> http://marc.theaimsgroup.com/?l=linux-netdev&m=112870885111441&w=4

Grrr, I really searched for the patch... :-)

> > I'm still wondering how other people are running a socks server
> > together with an iptables firewall. I can't imagine
> > they leave all incoming ports open...
>
> I have no idea. I can only assume most people simply don't allow
> users to open their own external ports on a firewall at all.

True that, but applications like ICQ or home banking software need this 
sometimes. I guess they don't firewall their socks server at all.

Cheers,
Thomas