On Thu, 3 Jul 2008, Jan Engelhardt wrote: > > > >TODO: add IPv6 support to kernel side > > > >Examples: > > > > Egress filtering: > > iptables -A FORWARD -m route ! --route-src-exists -j DROP > > That's what rp_filter is for. > > > Ingress filtering: > > iptables -A FORWARD -i $EXTERNAL_IF -m route --route-src-exists -j DROP > > rp_filter again. Quick and not good examples, I'd say. The main problem with rp_filter is that it drops the packets >silently<. The real benefit of such a match is the possibility to log (and drop) faked packets. If the patch had IPv6 support, one could add that additionally (as far as I know) there's no rp_filter for IPv6 at all. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
