Hey,
The way iptables rules are working is "first match" so in the case of an
ACCEPT rule it will only be ACCEPTED if it matches the rule else it will
try the next rule.
Always there was a need to add two rules to match an ESTABLISHED,RELATED.
1 - For the NEW state
2 - For the ESTABLISHED,RELATED
As long these rules are there with an ACCEPT target it will always be fine.
The main consideration is what will be faster to match from the two?
From what I have seen until now FW rules usually have an
ESTABLISHED,RELATED rule first and then the other NEW rules.
If it's right to "hijack" the thread for this particular case:
Which is better to be first?
Eliezer
On 22/01/2015 12:10, Mart Frauenlob wrote:
Hello,
the way I understand the change is:
you need to add an according iptables rule for the first state NEW
packet, which will then load the according conntrack helper
automatically. So further packets are classified as ESTABLISHED or RELATED.
There is no mechanism of unloading a module once it has been loaded afaik.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
