From: Christian Seberino <seberino@spawar.navy.mil>
To: Patrick Schaaf <bof@bof.de>
Cc: netfilter@lists.samba.org
Subject: Re: how is this stuff getting thru default deny iptables firewall?....
Date: Tue, 9 Jul 2002 12:08:52 -0700 [thread overview]
Message-ID: <20020709120852.A24804@spawar.navy.mil> (raw)
In-Reply-To: <20020627093730.C1873@oknodo.bof.de>; from bof@bof.de on Thu, Jun 27, 2002 at 09:37:30AM +0200
> On the other hand, if there is not yet a conntrack record in existence
> for the packet, the nat PREROUTING table is consulted
Patrick
I appreciate all your help and after thinking about this on my vacation
last week I think I got it now thanks to your feedback!
Can I ask you few questions to verify I got what you said regarding
how a private LAN can use DNS, HTTP, SMTP, etc. thru an SSH-only firewall?...
My main confusion I believe was that packets associated with preexisting
conntracks are handled differently than packets *not* associated
with a previous conntrack.
Q1: The conntrack is the "memory" of netfilter that allows it to make
decisions based on "history" of PC traffic right?
Q2: Packets with a previous associated conntrack are handled *differently* than ones
without previous conntrack... and any attempt to try to understand
behavior of firewall *without* this concept is doomed
to confusion right?
Q3: Is conntrack a new "iptables only" feature? I imagine ancient ipchains/ipfwadmin
would have had same issues and therefore would need something like
"conntrack" to work correctly right?
Sincerely,
Chris
--
_______________________________________
Dr. Christian Seberino
SPAWAR Systems Center San Diego
Code 2363
53560 Hull Street
San Diego, CA 92152-5001
U.S.A.
Phone: (619) 553-7940
Fax: (619) 553-2836
Email: seberino@spawar.navy.mil
_______________________________________
next prev parent reply other threads:[~2002-07-09 19:08 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-22 17:30 how is this stuff getting thru default deny iptables firewall? Christian Seberino
2002-06-22 17:38 ` Antony Stone
2002-06-23 7:13 ` Christian Seberino
2002-06-23 7:53 ` Patrick Schaaf
2002-06-27 7:21 ` Christian Seberino
2002-06-27 7:37 ` Patrick Schaaf
2002-07-09 19:08 ` Christian Seberino [this message]
2002-06-23 8:07 ` Antony Stone
2002-06-27 7:14 ` Christian Seberino
2002-06-27 7:28 ` Patrick Schaaf
-- strict thread matches above, loose matches on Subject: below --
2002-06-22 21:43 James T. Moore
2002-06-23 7:13 ` Christian Seberino
2002-07-09 19:43 j davis
2002-07-09 21:41 ` Christian Seberino
2002-07-09 21:43 ` Christian Seberino
[not found] ` <Pine.LNX.4.33.0207101903030.1723-100000@dodobirdy.nestac.com>
2002-07-10 16:34 ` Christian Seberino
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020709120852.A24804@spawar.navy.mil \
--to=seberino@spawar.navy.mil \
--cc=bof@bof.de \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox