On Wednesday 2015-07-15 18:55, Pablo Neira Ayuso wrote: >> >> +-p esp -m esp;-p esp -m esp --espspi 0;FAIL >> >> -p esp -m esp;=;OK >> > > >Given that this is changing the behaviour again, I would suggest that >-p esp -m esp displays -p -m esp --espspi 0:4294967295 via >iptables-save. The printing via iptables -S was not the problem. The patch is about that no AH/ESP packets were matched when using just "-m esp" because of the implied --espspi 0:0. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
