On Fri, Dec 11, 2015 at 07:53:12AM -0500, Satish Patel wrote: > I'm testing this rule from remote machine and sending fragmented packet using hping3 utility. > > -f iptables option is not going to work if conntrack there. > > I don't know why it's so hard for iptable to block something like this. You got nf_defrag_ipv4 loaded (it comes with conntrack), therefore, fragments are reassembled before entering conntrack, then fragmented back from the output path. In nftables you can add a chain *before* priority -400 that should see fragmented packets. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
