You *must* use the rule
iptables -t raw -A PREROUTING -s 1.2.3.4 -p tcp --sport 5678 -j NOTRACK
as well, otherwise conntrack will pick up the reply packets from the TARPIT target.
Very good point.
You *must* use the rule
iptables -t raw -A PREROUTING -s 1.2.3.4 -p tcp --sport 5678 -j NOTRACK
as well, otherwise conntrack will pick up the reply packets from the TARPIT target.
Very good point.
|