On Friday 2010-05-14 14:27, Markus Feldmann wrote: > > i am thinking about changing much of my firewall rules from the old style with > the <--syn> argument to the new style with the <-m state --state NEW> or to the > conntrack style. > > For example have a look line 221 to 239 in my firewall > http://pastebin.com/cG0Vc4EW > > These are my FTP rules. Therefore i am only using the <! --syn> arguments. Is > it useful to remove this argument by inserting <-m conntrack ! --cstate NEW> to > get more safety ? You could combine --syn with --ctstate NEW. That may be considered a bonus (though I admit I don't do so myself). -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
