On Tuesday 2011-01-11 13:35, Alessandro Vesely wrote: >Hi all, >this is clearly an overworked topic. However, I haven't been able to >find definitive info about it. Please help providing more insight. >In particular, if it is possible/convenient to design an RST injector >that uses libnetfilter_queue and how to attach it to iptables? (I >would only send a RST to the local host/network.) If you use a ruleset that emits RST for NEW connections that are picked up rather than SYN-new, -m conntrack --ctstate NEW -p tcp ! --syn --dport 22 -j REJECT --reject-with tcp-reset .. makes it possible to RST-kill connections using `conntrack -D`. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
