Mart Frauenlob schrieb:
Yes, if the OP would have looked up the original post correctly it would
show exactly that.
http://eeek.borgchat.net/lists/netfilter/msg47205.html
Putting the global RELATED rule, of course makes most of the rules
obsolete (which fits in most cases), but that example was to show how to
use the (ftp) helper match, if one chooses to split things up for
whatever reason.
Hi Mart,
I use the helper too. And the reason is that i do not want that pakets
are accepted, which are not related to ftp.
--sport 1024: --dport 1024: ACCEPT
means to accept mostly all pakets. But thats not what i and jeff want. I
think it is a security risk. I am not sure whether this works, but for
example if you connect to someone over any service and the remote host
try to connect to you back (RELATED,ESTABLISHED) but not only to the
original service, but also to your ftp service.
The next advantage is that my monitoring is not affected. I am using
<iptables -L -n -v> to watch which chain has traffic and sometimes i
found security holes over this monitor. If all traffic goes over my ftp
rule, than this does not work.
regards Markus
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
