Hi, I have a doubt regarding statefull feature in iptables firewall In my iptables filter table i set the default policy for INPUT,OUTPUT and FORWARD as DROP. so all packets are dropped. now i added a policy iptables -A INPUT -p icmp -m state --state NEW,ESTABLISHED -j ACCEPT My assumption is that when an external device sends a ping request(echo-request) its state will be NEW and it will be accepted,since for this a state table is being maintained,the ping reply should be sent through OUTPUT chain with out being blocked.but the packet is dropped in the OUTPUT chain. I understand that the rule we added is only for INPUT chain,but is a rule in OUTPUT chain required to send the reply packet out even for a legitimate packet that we accepted?? Regards, Shyam. - To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
