On 11/2/2008 9:00 PM, Maximilian Wilhelm wrote:
So you have to input all your rules via a GUI which does not accept
'--state NEW' right?
As an aside, one might question why you are using such a limiting tool. :(
Asuming yes and the you catch all '--state ESTABLISHED,RELATED'
packet which are/could be answer packets to outbound connections, how
about just leaving '--state NEW' out and DROP'ing all packets
remaining? Obviously after all rules which should accept things.
*nod*
This will work.
As far as TCP, you could watch for the SYN and ACK flag and filter out
any packet that has are not fully established, i.e. SYN,ACK ACK.
DROP'ing unwanted packets IMO is rather bad behavior as it makes
debugging (possible) network problems a lot harder. If you just
REJECT packets you don't want (with a appropriate limit) everybody
knows he is not welcome. So IMO it would be nicer to use '-j REJECT
--reject-with icmp-admin-prohibited'.
Agreed.
However you need to make sure that you will not reject packets with
spoofed source address in to your network. Consider Reverse Path filtering.
Grant. . . .
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
