also sprach Pascal Hambourg <pascal.mail@xxxxxxxxxxxxxxx> [2008.04.03.1129 +0200]: > Are you using a 2.6.18 kernel image from Debian etch or a custom one ? Debian's. > IPv6 conntrack requires the (now not so) new nf_conntrack, but in kernel > versions older than 2.6.20 nf_conntrack did not support IPv4 NAT yet. > Only the old ip_conntrack, the IPv4-only conntrack, did. So IPv6 > conntrack and IPv4 NAT were mutually exclusive. AFAIK 2.6.18 kernel > images from Debian etch are built with ip_conntrack in order to support > IPv4 NAT, and do not support IPv6 conntrack. Excellent explanation, thanks. I can confirm that nf_* modules are not present in Debian's 2.6.18, but they are with 2.6.24. also sprach Nicolas KOWALSKI <niko@xxxxxxxxxxxxxxxxx> [2008.04.03.1136 +0200]: > I noticed the same behaviour on Etch + kernel 2.6.22 (from > backports.org): ICMPv6 echo replies are matched by INVALID. See http://marc.info/?l=netfilter&m=120717177831833&w=2 And this is still the case with 2.6.24. -- martin | http://madduck.net/ | http://two.sentenc.es/ "whale feces or working at microsoft? i would probably be the whale feces researcher. salt air and whale flatulence; what could go wrong?" -- michael moyer, executive editor of _popular science_ spamtraps: madduck.bogus@xxxxxxxxxxx
Attachment:
digital_signature_gpg.asc
Description: Digital signature (see http://martin-krafft.net/gpg/)
