On Friday 2008-06-20 14:49, Doug Kehn wrote: > >The connections do hang if I change the rule to: > >iptables -t raw -A PREROUTING -d ! 192.168.2.0/255.255.255.0 -i eth0 >-p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK ACK -m tcp --dport 80 -j >NOTRACK > >This makes sense, I believe, because the ACK to the SYN-ACK wouldn't >be tracked and the connection state would never reach ESTABLISHED. The connection is established once conntrack sees the SYNACK. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
