Re: Theoretical question: need for filter table in the POSTROUTING chain

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On Thursday 2011-08-25 17:30, Gáspár Lajos wrote:

>
>> How about putting a reject route in the kernel routing table?
> Yeah.. that is an alternative...
> But:
> - I want to REJECT any tcp sessions with tcp-reset,
> - and any other protocoll with icmp-admin-prohibited.
> - I would like to do it in iptables/netfilter.
>
> The main question is: Why do not we have such a table in the POSTROUTING chain?

If they did not go through nat, the packet's computed state was most 
likely INVALID or UNTRACKED to begin with. And that you can already 
filter for in FORWARD.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Linux Netfilter Development]     [Linux Kernel Networking Development]     [Linux Networking Development]     [Linux Kernel Development]     [Linux Resources]     [LARTC]     [Bugtraq]     [Consulting]     [Free Internet Dating]     [Yosemite Forum]     [Photo]

Add to Google Powered by Linux