I always place the rule to accept established/related on the first line, so
that kernel matches most of the packets by the first rule. If you do the
same, first example is meaningless, IMHO
--------------------------------------------------
From: "Peter Renzland" <peter@xxxxxxxxxxx>
Sent: Friday, January 23, 2009 10:24 PM
To: <netfilter@xxxxxxxxxxxxxxx>
Subject: Why --syn on tcp connlimit?
I have often seen rules such as:
iptables -I FORWARD -p tcp --syn -m iprange --src-range
192.168.1.10-192.168.1.250 -m connlimit --connlimit-above 150 -j DROP
How is this, in effect, different from?:
iptables -I FORWARD -p tcp -m iprange --src-range
192.168.1.10-192.168.1.250 -m connlimit --connlimit-above 150 -j DROP
It's seems at best redundant, and at worst risky. But I am very new at
this and must be missing something. :-)
Thanks.
Peter
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
