Re: looking for suggestions
I guess what I was asking is do you NEED the --state NEW to use the other
states, like in BSD?
--- Douglas Maxwell <doug@turinglabs.com> wrote:
> On Tue, May 11, 2004 at 09:15:24AM -0700, Mike Mestnik wrote:
> > > iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> > > iptables -A OUTPUT -m state --state NEW -j ACCEPT
> > >
> > I have seen this context used on BSD there it is manditory to allow
> > "--state NEW"(with diffrent syntax) but "--state ESTABLISHED,RELATED"
> is
> > silently added to another 'expected' table. I was wondering what
> ipfilter
> > NEEDs to operate?
>
> I think you meant iptables? It doesn't absolutely *need* the
> ESTABLISHED, RELATED rule, but it won't put it in by default. So if
> you are accepting NEW packets, and you do not have the ESTABLISHED,
> RELATED rule, you will have to explicitly allow future traffic, in
> both directions. This is the way ipchains was - you could accept some
> NEW connections (TCP only - by checking the SYN flag), but had to
> create bi-directional rules for traffic beyond that.
>
> Doug
>
>
__________________________________
Do you Yahoo!?
Win a $20,000 Career Makeover at Yahoo! HotJobs
http://hotjobs.sweepstakes.yahoo.com/careermakeover
Reply to: