On Thu, 3 Jul 2008, Jan Engelhardt wrote:
On Thursday 2008-07-03 11:50, Jozsef Kadlecsik wrote:
Ingress filtering:
iptables -A FORWARD -i $EXTERNAL_IF -m route --route-src-exists -j DROP
rp_filter again.
Quick and not good examples, I'd say. The main problem with rp_filter is
that it drops the packets >silently<. The real benefit of such a match is
the possibility to log (and drop) faked packets. If the patch had IPv6
support, one could add that additionally (as far as I know) there's no
rp_filter for IPv6 at all.
You know what's been bugging me... why don't we replace the entire
routing infrastructure by an xtables "route" table, with something like
Because routing in a firewall is slow and too complicated?
Best regards,
Krzysztof Olędzki
