Zapis pravidel v iptables

[Peter Surda]

On Sat, Jun 12, 2004 at 07:17:57PM +0200, Dalibor Straka wrote:
> On Sat, Jun 12, 2004 at 04:09:52PM +0200, Peter Surda wrote:
> > 
> > > # FORWARD (pruchod serverem)
> > > iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
> > A toto je co? Nema syn a zaroven je NEW? Mam dojem za take neexistuju. Keby sa
> > niekto snazil fejkovat nove spojenie, bolo by INVALID a nie NEW.
> V linuxu ano, ale pokud ten firewall ma chranit i windowsi stroje,
> nechal bych ho tam. Maji ten tcp/ip stack pomrvenej, berou i paket
> ACK, ktery zahajuje novou session a rovnou obsahuje data. Takze zadny
> 3way handshake.
Nepytal som sa, ci take pakety niekto generuje, ale ci su interpretovane ako
NEW. Podla mna nie -> pravidlo je nepotrebne.

> -- Dalibor Straka
S pozdravom,

Peter Surda (Shurdeek) <shurdeek na routehat.org>, ICQ 10236103, +436505122023

-- 
Actually, Microsoft is sort of a mixture between the Borg and the Ferengi.