On Mon, 4 Aug 2008, Patrick McHardy wrote: > Jan Engelhardt wrote: > > > > This just happened to be within my thoughts. Comments, declinations? > > Well, first thought is the usual fear of breaking setups. > > But I do agree that this makes sense, we've had a number > of "bugreports" over the years from people how tried to > do filtering in the nat table and didn't realize it only > sees the first packet of a connection. > > Not sure - anyone else with an opinion? :) Instead of the line + exit_error(OTHER_PROBLEM, "The nat table is not for filtering"); the next one would probably be little bit more user friendly: + fprintf(stderr, "The nat table is not for filtering, next iptables release won't support it at all. Fix your setup.\n"); And in the next release it could be changed to 'exit_error'. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
