On Friday 2008-06-20 12:21, Patrick McHardy wrote: > Jan Engelhardt wrote: >> On Friday 2008-06-20 01:57, Doug Kehn wrote: >> >> > iptables -t raw -A PREROUTING -d ! 192.168.2.0/24 -i br0 >> > -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK ACK -m tcp --dport 80 -m >> > conntrack --ctstate ESTABLISHED -j NOTRACK >> > >> > Does this even make sense? >> >> Yes, but: > > No. The raw table doesn't have conntrack information. > Oops ;-) But you can assume that any ACK belongs to an established connection, hence omitting -m conntrack --ctstate ESTABLISHED would achieve the same. Of course there are scenarios, like probe ACKs sent by nmap that do not belong to any, or a conntrack router B which got rebooted (and hence lost the connections that are still active between two hosts A and C), but that should be real corner cases. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
