On Tuesday 2012-04-24 10:49, John Lister wrote: > A quick perusal, shows a couple of things. Firstly I'm not familiar with the > conntrack or physdev modules, I'd just use the state module and -i respectively > - but i'd imagine they do the same. conntrack does more than state, so in any case you should definitely use it. physdev is obviously required for bridge (if there is one) interaction. >> I have a working config, my internal network can get out to the >> internet but because of a lack of understanding I have opened up SSH >> on the firewall to the internet: >> >> 1# Generated by iptables-save v1.4.12 on Tue Apr 24 16:51:19 2012 >> 2*mangle >> 3:PREROUTING ACCEPT [3292:1334085] >> 4:INPUT ACCEPT [462:36946] >> 5:FORWARD ACCEPT [2826:1297011] >> 6:OUTPUT ACCEPT [268:37651] >> 7:POSTROUTING ACCEPT [3075:1327352] >> 8-A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss >> --mss 1400:65495 -j TCPMSS --clamp-mss-to-pmtu One does not really need TCPMSS, for there is PMTUD. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
