On 19/06/09 12:18, Benedikt Gollatz wrote:
I am not an iptables expert, but to me it seems the first MASQUERADE
rule matches all packets and the new one does not make any difference.
Can someone confirm that ?
That's absolutely true. The rule from the FAQ is meant to replace your
original rule, exempting proto-41 traffic from masquerading and thus
connection tracking.
I believe the idea is that if you are terminating the tunnel on your
router, then this rule should replace your default MASQUERADE rule so
instead of
MASQUERADE all -- anywhere anywhere
MASQUERADE !ipv6 -- anywhere anywhere
you should have just:-
MASQUERADE !ipv6 -- anywhere anywhere
This way the connection is not tracked unnecessarily.
Regards,
Chris Hills
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
