On Tue, 2003-01-14 at 16:06, Christian Hammers wrote: > > On Tue, Jan 14, 2003 at 02:43:45PM +0100, Filip Sneppe wrote: > > About the high nuber of tracked connections, are you > > talking about /proc/net/ip_conntrack ? > Yes. As wrote in my previous mail (should have written it here, too), Ah - that mail - I already deleted it from my mailbox. > this router does asymetric routing, i.e. the packets for a connection > come in over it but the answer packets go out via another router. > So it will almost never see a real 3way tcp handshake or the like. > Wel, connection tracking was not really designed to handle asymetric routing setups, so you're basically screwed. No stateful packet filtering firewall will handle this decently, I guess. On thing you can do, is apply the 'raw' patch from patch-o-matic (written by Jozsef Kadlecsik), this allows you not to track particular traffic. In your case, you will need to specify rules for all (asymetric) traffic that should not be tracked by your firewall. If *all* your traffic is essentially asymetric in nature, you'de be better off not using ip_conntrack at all... Hope this helps... Regards, Filip
