From mboxrd@z Thu Jan 1 00:00:00 1970 From: "j davis" Subject: Re: how is this stuff getting thru default deny iptables firewall?.... Date: Tue, 09 Jul 2002 19:43:42 +0000 Sender: netfilter-admin@lists.samba.org Message-ID: Mime-Version: 1.0 Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; format=flowed; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.samba.org ipchains is not stateful so it doesnt need contrak...right? jd >From: Christian Seberino >To: Patrick Schaaf >CC: netfilter@lists.samba.org >Subject: Re: how is this stuff getting thru default deny iptables >firewall?.... >Date: Tue, 9 Jul 2002 12:08:52 -0700 >MIME-Version: 1.0 >Received: from [198.186.203.85] by hotmail.com (3.2) with ESMTP id >MHotMailBEF485390058400431CEC6BACB5599E90; Tue, 09 Jul 2002 12:32:25 -0700 >Received: from va.samba.org (localhost [127.0.0.1])by lists.samba.org >(Postfix) with ESMTPid BD14F424A; Tue, 9 Jul 2002 12:32:11 -0700 (PDT) >Received: from dt092n42.san.rr.com (dt092n42.san.rr.com [204.210.48.66])by >lists.samba.org (Postfix) with ESMTP id 8B4534A48for >; Tue, 9 Jul 2002 12:07:26 -0700 (PDT) >Received: from seberino by dt092n42.san.rr.com with local (Exim 3.32 #1)id >17S0M0-0006ST-00; Tue, 09 Jul 2002 12:08:52 -0700 >From netfilter-admin@lists.samba.org Tue, 09 Jul 2002 12:33:44 -0700 >Delivered-To: netfilter@lists.samba.org >Message-ID: <20020709120852.A24804@spawar.navy.mil> >References: <20020622103055.B32585@spawar.navy.mil> ><20020622173842.AGM19225.mta07-svc.ntlworld.com@there> ><20020623001302.A949@spawar.navy.mil> <20020623095351.M5183@oknodo.bof.de> ><20020627002144.B13910@spawar.navy.mil> ><20020627093730.C1873@oknodo.bof.de> >User-Agent: Mutt/1.2.5i >In-Reply-To: <20020627093730.C1873@oknodo.bof.de>; from bof@bof.de on Thu, >Jun 27, 2002 at 09:37:30AM +0200 >Sender: netfilter-admin@lists.samba.org >Errors-To: netfilter-admin@lists.samba.org >X-BeenThere: netfilter@lists.samba.org >X-Mailman-Version: 2.0.8 >Precedence: bulk >List-Help: >List-Post: >List-Subscribe: >, >List-Id: netfilter user discussion list >List-Unsubscribe: >, >List-Archive: > > > On the other hand, if there is not yet a conntrack record in existence > > for the packet, the nat PREROUTING table is consulted > >Patrick > >I appreciate all your help and after thinking about this on my vacation >last week I think I got it now thanks to your feedback! >Can I ask you few questions to verify I got what you said regarding >how a private LAN can use DNS, HTTP, SMTP, etc. thru an SSH-only >firewall?... > >My main confusion I believe was that packets associated with preexisting >conntracks are handled differently than packets *not* associated >with a previous conntrack. > >Q1: The conntrack is the "memory" of netfilter that allows it to make >decisions based on "history" of PC traffic right? > >Q2: Packets with a previous associated conntrack are handled *differently* >than ones >without previous conntrack... and any attempt to try to understand >behavior of firewall *without* this concept is doomed >to confusion right? > >Q3: Is conntrack a new "iptables only" feature? I imagine ancient >ipchains/ipfwadmin >would have had same issues and therefore would need something like >"conntrack" to work correctly right? > >Sincerely, > >Chris >-- >_______________________________________ > >Dr. Christian Seberino >SPAWAR Systems Center San Diego >Code 2363 >53560 Hull Street >San Diego, CA 92152-5001 >U.S.A. > >Phone: (619) 553-7940 >Fax: (619) 553-2836 >Email: seberino@spawar.navy.mil >_______________________________________ > thanks, jd jd@taproot.bz http://www.taproot.bz _________________________________________________________________ MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx