From: "Ming-Ching Tiew" <mingching.tiew@redtone.com>
To: netfilter@lists.netfilter.org
Subject: Re: DNAT for two external NIC
Date: Tue, 5 Sep 2006 10:29:42 +0800 [thread overview]
Message-ID: <01d101c6d093$2713d960$0100a8c0@newlife> (raw)
From: "Ming-Ching Tiew" <mingching.tiew@redtone.com>
>
> I did not go through your post carefully enough to know what you are talking
> about. But my question was why do we have to turn off reverse filter path
> checking to get multipath routing to work ? The original idea of reverse
> filter path checking is to improve security by doing reverse path checking,
> ie by checking the source IP address of all packets coming in via an interface
> against the networks known to be behind that interface, the firewall/router
> can simply drop packets that aren't supposed to come from there. In the
> multipath routing case, the packets are INDEED supposed to be from the
> interface where it is coming from, why they are dropped ?
>
Perhaps this is what this patch is all about ?
http://www.ssi.bg/~ja/#rp_filter_mask
I have noticed that Julian Anastasov's patch has existed long long time ago
but it is never included into the standard kernel. I really wonder why.
Cheers.
next reply other threads:[~2006-09-05 2:29 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-09-05 2:29 Ming-Ching Tiew [this message]
-- strict thread matches above, loose matches on Subject: below --
2006-09-01 6:32 DNAT for two external NIC Ming-Ching Tiew
2006-09-01 8:35 ` longraider
2006-09-01 9:32 ` Ming-Ching Tiew
2006-09-01 1:01 Mikhail
2006-08-29 21:42 Mikhail
2006-08-29 22:00 ` Pascal Hambourg
2006-08-30 7:15 ` Florent Guiliani
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='01d101c6d093$2713d960$0100a8c0@newlife' \
--to=mingching.tiew@redtone.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox