>> On 02/27/2010 10:06 AM, ratheesh k wrote: >>> Port is in Layer 4 of protocol stack . > > Very useless response ... > Very true . No more top posting . I did it by mistake .sorry. Thanks, Ratheesh On Sun, Feb 28, 2010 at 12:24 PM, Mart Frauenlob <mart.frauenlob@xxxxxxxxx> wrote: > On 27.02.2010 17:17, netfilter-owner@xxxxxxxxxxxxxxx wrote: >> U'll have to let me know why "-p udp" is needed when the chain can only >> have udp packets, and therefor can only process udp packets. >> >> I dont want to test over (( and over ) and over ) again when I know that >> the packet is already KNOWN to be from eth1 and of protocol UDP. > > now if we add -p icmp -j PRE_UDP, what should iptables do now? > > use 'ferm' if you are too lazy to write iptables rules: > http://ferm.foo-projects.org/ > >> >> adding "-p UDP" to multiport does make iptables happy, but appears to be >> a useless test. >> >> On 02/27/2010 10:06 AM, ratheesh k wrote: >>> Port is in Layer 4 of protocol stack . > > Very useless response ... > > >>> >>> >>> On Sat, Feb 27, 2010 at 8:33 PM, U. George<netbeans@xxxxxxxxxxxx> wrote: >>>> In order to get to the chain, the protocol, as well as the interface >>>> must >>>> match. PRE_UDP if already filtered for "-p udp" . So why does multiport >>>> require another check for -p udp? Does it really need to have that >>>> option in >>>> order for it to work? >>>> >>>>> + /sbin/iptables -t filter -N PRE_UDP >>>>> + /sbin/iptables -t filter -A INPUT -i eth1 -p udp -j PRE_UDP >>>>> + /sbin/iptables -t filter -A PRE_UDP -m multiport --dport >>>>> 137,138,139,512,514,515,1433,1434 -j DROP >>>>> iptables v1.4.5: multiport needs `-p tcp', `-p udp', `-p udplite', `-p >>>>> sctp' or `-p dccp' >>>>> Try `iptables -h' or 'iptables --help' for more information. > > > TOP POSTING is <-- censored -->... > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
