Re: conntrack/state with QUEUE target

[Udo Schneider <Udo.Schneider@homeaddress.de>]

All,

> This worked fine. Now however we have the requirement for more granular 
> "stateful" Rules. I though it should be possible to combine 
> state/conntrack with the QUEUE target ... but this doesn't seem to work.
> 
> -t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED 
> -j QUEUE

I think I got it.

-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED 
-j QUEUE
-t mangle -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED
-j QUEUE

This combination seems to work. Coming from a Check Point Background I 
assumed that the statefulness provided by state/conntrack means that I 
only have to specify the initiating connection - replies are 
accepted/queued automagically based on connection data.

However I seem to be wrong - or did I completely miss the point?

CU,

Udo