From: "j davis" <davis_compz@hotmail.com>
To: netfilter@lists.samba.org
Subject: Re: how is this stuff getting thru default deny iptables firewall?....
Date: Tue, 09 Jul 2002 19:43:42 +0000 [thread overview]
Message-ID: <F1442JB1ndcx3Vp20N30000b94a@hotmail.com> (raw)
ipchains is not stateful so it doesnt need contrak...right?
jd
>From: Christian Seberino <seberino@spawar.navy.mil>
>To: Patrick Schaaf <bof@bof.de>
>CC: netfilter@lists.samba.org
>Subject: Re: how is this stuff getting thru default deny iptables
>firewall?....
>Date: Tue, 9 Jul 2002 12:08:52 -0700
>MIME-Version: 1.0
>Received: from [198.186.203.85] by hotmail.com (3.2) with ESMTP id
>MHotMailBEF485390058400431CEC6BACB5599E90; Tue, 09 Jul 2002 12:32:25 -0700
>Received: from va.samba.org (localhost [127.0.0.1])by lists.samba.org
>(Postfix) with ESMTPid BD14F424A; Tue, 9 Jul 2002 12:32:11 -0700 (PDT)
>Received: from dt092n42.san.rr.com (dt092n42.san.rr.com [204.210.48.66])by
>lists.samba.org (Postfix) with ESMTP id 8B4534A48for
><netfilter@lists.samba.org>; Tue, 9 Jul 2002 12:07:26 -0700 (PDT)
>Received: from seberino by dt092n42.san.rr.com with local (Exim 3.32 #1)id
>17S0M0-0006ST-00; Tue, 09 Jul 2002 12:08:52 -0700
From netfilter-admin@lists.samba.org Tue, 09 Jul 2002 12:33:44 -0700
>Delivered-To: netfilter@lists.samba.org
>Message-ID: <20020709120852.A24804@spawar.navy.mil>
>References: <20020622103055.B32585@spawar.navy.mil>
><20020622173842.AGM19225.mta07-svc.ntlworld.com@there>
><20020623001302.A949@spawar.navy.mil> <20020623095351.M5183@oknodo.bof.de>
><20020627002144.B13910@spawar.navy.mil>
><20020627093730.C1873@oknodo.bof.de>
>User-Agent: Mutt/1.2.5i
>In-Reply-To: <20020627093730.C1873@oknodo.bof.de>; from bof@bof.de on Thu,
>Jun 27, 2002 at 09:37:30AM +0200
>Sender: netfilter-admin@lists.samba.org
>Errors-To: netfilter-admin@lists.samba.org
>X-BeenThere: netfilter@lists.samba.org
>X-Mailman-Version: 2.0.8
>Precedence: bulk
>List-Help: <mailto:netfilter-request@lists.samba.org?subject=help>
>List-Post: <mailto:netfilter@lists.samba.org>
>List-Subscribe:
><http://lists.samba.org/listinfo/netfilter>,<mailto:netfilter-request@lists.samba.org?subject=subscribe>
>List-Id: netfilter user discussion list <netfilter.lists.samba.org>
>List-Unsubscribe:
><http://lists.samba.org/listinfo/netfilter>,<mailto:netfilter-request@lists.samba.org?subject=unsubscribe>
>List-Archive: <http://lists.samba.org/pipermail/netfilter/>
>
> > On the other hand, if there is not yet a conntrack record in existence
> > for the packet, the nat PREROUTING table is consulted
>
>Patrick
>
>I appreciate all your help and after thinking about this on my vacation
>last week I think I got it now thanks to your feedback!
>Can I ask you few questions to verify I got what you said regarding
>how a private LAN can use DNS, HTTP, SMTP, etc. thru an SSH-only
>firewall?...
>
>My main confusion I believe was that packets associated with preexisting
>conntracks are handled differently than packets *not* associated
>with a previous conntrack.
>
>Q1: The conntrack is the "memory" of netfilter that allows it to make
>decisions based on "history" of PC traffic right?
>
>Q2: Packets with a previous associated conntrack are handled *differently*
>than ones
>without previous conntrack... and any attempt to try to understand
>behavior of firewall *without* this concept is doomed
>to confusion right?
>
>Q3: Is conntrack a new "iptables only" feature? I imagine ancient
>ipchains/ipfwadmin
>would have had same issues and therefore would need something like
>"conntrack" to work correctly right?
>
>Sincerely,
>
>Chris
>--
>_______________________________________
>
>Dr. Christian Seberino
>SPAWAR Systems Center San Diego
>Code 2363
>53560 Hull Street
>San Diego, CA 92152-5001
>U.S.A.
>
>Phone: (619) 553-7940
>Fax: (619) 553-2836
>Email: seberino@spawar.navy.mil
>_______________________________________
>
thanks,
jd
jd@taproot.bz
http://www.taproot.bz
_________________________________________________________________
MSN Photos is the easiest way to share and print your photos:
http://photos.msn.com/support/worldwide.aspx
next reply other threads:[~2002-07-09 19:43 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-07-09 19:43 j davis [this message]
2002-07-09 21:41 ` how is this stuff getting thru default deny iptables firewall? Christian Seberino
2002-07-09 21:43 ` Christian Seberino
[not found] ` <Pine.LNX.4.33.0207101903030.1723-100000@dodobirdy.nestac.com>
2002-07-10 16:34 ` Christian Seberino
-- strict thread matches above, loose matches on Subject: below --
2002-06-22 21:43 James T. Moore
2002-06-23 7:13 ` Christian Seberino
2002-06-22 17:30 Christian Seberino
2002-06-22 17:38 ` Antony Stone
2002-06-23 7:13 ` Christian Seberino
2002-06-23 7:53 ` Patrick Schaaf
2002-06-27 7:21 ` Christian Seberino
2002-06-27 7:37 ` Patrick Schaaf
2002-07-09 19:08 ` Christian Seberino
2002-06-23 8:07 ` Antony Stone
2002-06-27 7:14 ` Christian Seberino
2002-06-27 7:28 ` Patrick Schaaf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=F1442JB1ndcx3Vp20N30000b94a@hotmail.com \
--to=davis_compz@hotmail.com \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).