From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: Weird nat/conntrack Problem with PASV FTP upload Date: Mon, 09 Jun 2008 11:09:08 +0200 Message-ID: <484CF334.3000200@trash.net> References: <4847F14D.5000806@trash.net> <484941F6.9080701@bringe.com> <48495174.30909@trash.net> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Sender: netfilter-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Jan Engelhardt Cc: =?ISO-8859-1?Q?Thomas_B=E4tzler?= , netfilter@vger.kernel.org Jan Engelhardt wrote: > On Friday 2008-06-06 17:02, Patrick McHardy wrote: > >>> I've tried that for a day, to no avail: >>> .. >>> My nat rules currently look like this: >>> >>> iptables -t nat -A PREROUTING -m state --state INVALID -j LOG >>> iptables -t nat -A PREROUTING -m state --state INVALID -j DROP >>> >> These rules need to go in mangle, that nat table is only >> traversed for the first packet of a connection. >> > > These rules should go into filter, because that's what "filter" > is for... filtering. As you are well aware, there is no PREROUTING chain in filter. So I'm guessing you're trying to pull me into a discussion about that, in an irritating way.