Hello, when I have these two rules on client side (Browser) # Allow anything out on WAN -A OUTPUT -o iface-wan -j ACCEPT # Allow established, related packets back in -A INPUT -i iface-wan -m state --state ESTABLISHED,RELATED -j ACCEPT or on firewalls/routers # Allow anything out on WAN -A FORWARD -i iface-lan -o iface-wan -j ACCEPT # Allow established, related packets back in -A FORWARD -i iface-wan -o iface-lan -m state --state ESTABLISHED,RELATED -j ACCEPT what happens to to packets that the Server pushes without request? I ask this because I see in the logs regularly a few entries like this [13-Sep-2017; 16:42:06.415850] IPv6[FWD]: IN=sit1 OUT=br0 SRC=2a00:1450:4001:0811:0000:0000:0000:200e DST=LANprefix:0000:0000:0000:1234 LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=262223 as I filtered away INVALID, I can imagine, that these blocked packets come from HTTP/2-Push ... Am i right? Greetings, Walter -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
