Hi,
2011-08-26 09:56 keltezéssel, Jan Engelhardt írta:
How about putting a reject route in the kernel routing table?
Yeah.. that is an alternative...
But:
- I want to REJECT any tcp sessions with tcp-reset,
- and any other protocoll with icmp-admin-prohibited.
- I would like to do it in iptables/netfilter.
The main question is: Why do not we have such a table in the POSTROUTING chain?
If they did not go through nat, the packet's computed state was most
likely INVALID or UNTRACKED to begin with. And that you can already
filter for in FORWARD.
I do not get it...
If a packet comes from the network then it is either goes to FORWARD or
to INPUT... (You can forget INPUT for now.) And there we have nat...
If a packet comes from the local computer then it leaves out on the
OUTPUT chain... And there we have nat again...
So every packet should be tracked at the POSTROUTING chain...
Yes, I can filter at the FORWARD and the OUTPUT chain... But why can't I
at the POSTROUTING???
I do not seek alternatives... (I found them... :D) I want to know why it
is not "enabled" ???
Thanx
Swifty
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
