On Monday 2008-06-23 15:55, Thomas Jacob wrote: >Could someone clarify what exactly the warning message in the subject >(from ip6tables) is supposed to tell me? > >It looks like that ip6tables -p ah (or -p in general) would match >packets that contain an ah header as the last extension header whereas >-m ah matches packets that contain an ah header at any position, but >I'm not sure. > >The core of the question is this: how does one pass unspecified >ipsec traffic in ip6tables (the way you could do with -p ah + -p esp in >iptables)? AH is never the last header in IPv6 (TCP/etc. follows), hence the warning. But ESP can be the last one. (And -p esp won't throw a warning.) -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
