From: Vincent Lim <vincent.lim@nestac.com>
To: dhiraj.2.bhuyan@bt.com
Cc: netfilter@lists.netfilter.org
Subject: Re: connection tracking query
Date: 07 Apr 2003 17:51:38 +0800 [thread overview]
Message-ID: <1049709098.1231.169.camel@vincentlim> (raw)
In-Reply-To: <7497DCA1C240C042B28F6657ADFD8E0926876C@i2km11-ukbr.domain1.systemhost.net>
On Mon, 2003-04-07 at 17:02, dhiraj.2.bhuyan@bt.com wrote:
<snip rest>
> but also in INPUT and POSTROUTING chain. What I find strange with this is
> that for a packet that goes through the "FORWARD" chain, "conntrack" is done
> twice on the same packet - first in the "PREROUTING" chain and second in the
> "POSTROUTING" chain. Does anyone have any explanation for this?
I think the first packet goes thru POSTROUTING, subsequent packets
(after their routes determined) goes straight to FORWARD.
>
> 2. If a packet is found to belong to an already ESTABLISHED connection, does
> it still have to go through the filter rules again?
I would think so. You need to explicitly have "-m state --state
ESTABLISHED, RELATED -j ACCEPT" to process those packets.
My $0.02
*awaits flame galore*
--
Vincent Lim <vincent.lim@nestac.com>
NESTAC Solution Sdn Bhd
next prev parent reply other threads:[~2003-04-07 9:51 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-04-07 9:02 connection tracking query dhiraj.2.bhuyan
2003-04-07 9:25 ` Oskar Andreasson
2003-04-07 9:51 ` Vincent Lim [this message]
2003-04-07 12:57 ` Cedric Blancher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1049709098.1231.169.camel@vincentlim \
--to=vincent.lim@nestac.com \
--cc=dhiraj.2.bhuyan@bt.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox