I think as long as you do not use an INPUT queue, leave it blank and
make it default accept, you do not need to use state.
Anything requiring an INPUT target though needs state.
-gc
Florin Andrei wrote:
I need to build a firewall in front of a cluster of HTTP servers. The
firewall has 2 interfaces, "inside" (facing the cluster) and "outside"
(facing the Internet).
Each server has a private IP address, so the firewall must translate
each server address to a public address on the external interface (I
guess that's called 1:1 NAT, it's exactly what a PIX firewall would do
via a "static (inside,outside) foobar-out foobar-in netmask
255.255.255.255" statement).
Since HTTP is the only thing traversing the firewall, I don't really
need a stateful firewall. In fact, in order to build some redundancy
into the firewalling layer, a stateless firewall is even better: I
just build 2 or more stateless firewalls and only transfer the IP and
MAC if the primary fails - no need to transfer the state.
Moreover, since the total bandwidth will be very high, that's one more
reason to not do stateful filtering (less work for the firewall).
The problem is, NAT seems to imply stateful filtering. The moment I
start playing with the nat table, the ip_conntrack module gets loaded.
Questions:
Is there a way to do NAT on a true stateless firewall? (no conntrack
loaded)
If the answer to the previous q is negative, can I just ignore
conntrack and build the filter and nat tables as if conntrack would
not exist? I'm trying to figure out if there's any interaction with
conntrack in this scenario, but I don't know netfilter well enough to
be 100% sure.
