On 14.09.2017 10:42, Walter H. wrote:
Hello, when I have these two rules on client side (Browser) # Allow anything out on WAN -A OUTPUT -o iface-wan -j ACCEPT # Allow established, related packets back in -A INPUT -i iface-wan -m state --state ESTABLISHED,RELATED -j ACCEPT or on firewalls/routers # Allow anything out on WAN -A FORWARD -i iface-lan -o iface-wan -j ACCEPT # Allow established, related packets back in -A FORWARD -i iface-wan -o iface-lan -m state --state ESTABLISHED,RELATED -j ACCEPT what happens to to packets that the Server pushes without request? I ask this because I see in the logs regularly a few entries like this [13-Sep-2017; 16:42:06.415850] IPv6[FWD]: IN=sit1 OUT=br0 SRC=2a00:1450:4001:0811:0000:0000:0000:200e DST=LANprefix:0000:0000:0000:1234 LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=262223 as I filtered away INVALID, I can imagine, that these blocked packets come from HTTP/2-Push ... Am i right? Greetings, Walter
p.s. this is not limited to IPv6, also IPv4 e.g.[17-Sep-2017; 08:42:21.259878] IP[IN]: IN=eth1 OUT= MAC=24:xx:xx:xx:xx:24:24:xx:xx:xx:xx:24:08:00 SRC=151.101.112.188 DST=#WAN-IP# LEN=115 TOS=0x00 PREC=0x00 TTL=59 ID=63615 DF PROTO=TCP SPT=443 DPT=53156 WINDOW=57 RES=0x00 ACK PSH URGP=0
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
