From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Calvin" Subject: why packet get through the netfilter even if i drop all in FORWARD Date: Sun, 8 Jun 2003 16:07:11 +1000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001e01c32d84$34f4fe70$95dc6f89@wonderland> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_001B_01C32DD8.04DB4290" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter-devel-request@lists.netfilter.org, netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_001B_01C32DD8.04DB4290 Content-Type: text/plain; charset="big5" Content-Transfer-Encoding: quoted-printable Dear all, I got a funny problem here and got no idea why it happen. my simple network is A |(eth0) GWa ||(eth1) || ||(eth1) GWb |(eth0) I running netfilter with freeswan, I add a rule in FORWARD chain to drop = all packets forward from internal iface(eth0) to public iface(eth1). iptables - A FORWARD -i eth0 -i eth1 -j DROP it works fine when , when i try to ping GWb's eth0 from machine A, it = get blocked. however once I start up the IPSEC, I do the ping again and A can ping = GWb's eth0. The rule in FORWARD chain is still there. Why does this happen? Is that anyway I can fix this? Thanks very much Calvin ------=_NextPart_000_001B_01C32DD8.04DB4290 Content-Type: text/html; charset="big5" Content-Transfer-Encoding: quoted-printable
Dear all,
 
I got a funny problem here and got no = idea why it=20 happen.
my simple network is
A
 |(eth0)
GWa
||(eth1)
||
||(eth1)
GWb
|(eth0)
 
I running netfilter with freeswan, I = add a rule in=20 FORWARD chain to drop all packets forward from
internal iface(eth0) to public=20 iface(eth1).
    iptables - A FORWARD = -i eth0 -i=20 eth1 -j DROP
 
it works fine when , when i try to ping = GWb's eth0=20 from machine A, it get blocked.
 
however once I start up the IPSEC, I do = the ping=20 again and A can ping GWb's eth0. The rule in FORWARD chain is still=20 there.
 
Why does this happen? Is that anyway I = can fix=20 this?
 
Thanks very much
Calvin
 
------=_NextPart_000_001B_01C32DD8.04DB4290--