Am 21.04.2014 11:38, schrieb Anton 'EvilMan' Danilov: > Hi, Sven. > > You can disable conntrack at all by removing of the module. Assume, the firewall protecting the router is stateful (i.e., it uses conntrack). > Also you can disable conntrack only for specifyed connections with CT > target (--notrack option). I know have the following three rules: iptables -t raw -A PREROUTING -d <router-ip> -j CT iptables -t raw -A PREROUTING -s <router-ip> -j CT iptables -t raw -A PREROUTING -j CT --notrack So any traffic directed at the router or coming from the router should be conntracked while all other traffic is not. Note, that I don't have any rules in the OUTPUT chain of the raw table, as it seems to me that the default (connections are conntracked) is fine. Do the above rules seem OK to you? Regards, Sven -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
