From mboxrd@z Thu Jan  1 00:00:00 1970
From: ads nat <adsnat@yahoo.com>
Subject: Re: IPTABLES syntax problem.
Date: Tue, 23 Dec 2003 05:56:29 -0800 (PST)
Sender: netfilter-admin@lists.netfilter.org
Message-ID: <20031223135629.38614.qmail@web60402.mail.yahoo.com>
References: <1072187328.820.106.camel@elendil.intranet.cartel-securite.net>
Mime-Version: 1.0
Return-path: <netfilter-admin@lists.netfilter.org>
In-Reply-To: <1072187328.820.106.camel@elendil.intranet.cartel-securite.net>
Errors-To: netfilter-admin@lists.netfilter.org
List-Help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-Post: <mailto:netfilter@lists.netfilter.org>
List-Subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>,
	<mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-Id: <netfilter.vger.kernel.org>
List-Unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>,
	<mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
List-Archive: <https://lists.netfilter.org/pipermail/netfilter/>
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
To: Cedric Blancher <blancher@cartel-securite.fr>, Chris Brenton <cbrenton@chrisbrenton.org>
Cc: ads nat <adsnat@yahoo.com>, netfilter@lists.netfilter.org

Yes, I have edited "iptables" manually and copies all
rule sets to it and then restarted with
"/etc/init.d/iptables restart"

Is it not allowed?
Thanks for support


--- Cedric Blancher <blancher@cartel-securite.fr>
wrote:
> Le mar 23/12/2003 =E0 14:19, Chris Brenton a =E9crit :
> > > -A INPUT -p tcp ! --syn -m state --state NEW -j
> LOG
> > > --log-prefix "New not syn:"
> > iptables -A INPUT -p tcp ! --tcp-flags SYN SYN -m
> state --state NEW -j
> > LOG --log-prefix " New not syn: "
>=20
> "--syn" is equivalent to "--tcp-flags SYN,RST,ACK
> SYN"
>=20
> I can confirme that iptables-save generates a
> --tcp-flag line :
>=20
> cbr@elendil:~$ sudo iptables -A INPUT -p tcp ! --syn
> -m state
> 		--state	NEW -j LOG
> cbr@elendil:~$ sudo iptables-save
> # Generated by iptables-save v1.2.8 on Tue Dec 23
> 14:44:17 2003
> [...]
> *filter
> :INPUT DROP [529:81210]
> [...]
> -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN
> -m state
> 		--state	NEW -j LOG
>=20
> So, for the OP (ads nat) : you seem to have modified
> your ruleset by
> hand and used a alias (--syn) that
> iptables-<save/restore> does not
> understand.
>=20
> --=20
> http://www.netexit.com/~sid/
> PGP KeyID: 157E98EE FingerPrint:
> FA62226DA9E72FA8AECAA240008B480E157E98EE
> >> Hi! I'm your friendly neighbourhood signature
> virus.
> >> Copy me to your signature file and help me
> spread!=20


__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree