>> In nftables you can add a chain *before* priority -400 that should see fragmented packets. what is nftables? How do i set priority? could you please explain? On Fri, Dec 11, 2015 at 12:22 PM, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > On Fri, Dec 11, 2015 at 07:53:12AM -0500, Satish Patel wrote: >> I'm testing this rule from remote machine and sending fragmented packet using hping3 utility. >> >> -f iptables option is not going to work if conntrack there. >> >> I don't know why it's so hard for iptable to block something like this. > > You got nf_defrag_ipv4 loaded (it comes with conntrack), therefore, > fragments are reassembled before entering conntrack, then fragmented > back from the output path. > > In nftables you can add a chain *before* priority -400 that should see > fragmented packets. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
