On 6/27/2007 12:09 PM, Mike Wright wrote:
My thought is that if no timestamp requests are accepted no timestamp replies would be generated. In case that's an invalid assumption you could also filter the output chain.
*nod*
Depending on what else you are doing you may need matching rules in your forward chains, too.
This is why a (sub)chain to do the filtering is nice. Jump to the same (sub)chain from both filter:INPUT and filter:FORWARD and return out of it with any traffic that passes back to the rule after the one that jumped in to it. Just have your (sub)chain DROP the packet if it does match and allow all non-matching traffic to fall off the end and RETURN. Seeing as how it is a (sub)chain, I don't think you can set a policy of RETURN and you would have to create a rule to RETURN, but this is a non-issue.
Grant. . . .
