On 12/09/2010 09:00 PM, Curtis Doty wrote: > Why must statefull connection tracking be imposed on every Fedora user? > > Don't get me wrong. I use netfilter all the time and love it. And it's > good to install the userland iptables tools and a simple firewall by > default. But when I'd like to choose Fedora without it (asymmetric > routing anyone?), I now have to rebuild the kernel. [harumph!] > > Was there ever a good reason for making the filter table and conntrack > modules monolithic? They certainly didn't used to be built in... > > ../C Seems like there should be an easy way to 'opt-out' of connection tracking. Have you tried anything like 'iptables -t raw -I PREROUTING -j NOTRACK' ? The iptables man-page says this about the 'raw' table: " This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target. It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes) " Cheers. -Jeff -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel
