Re: looking for suggestions
On Tue, May 11, 2004 at 09:15:24AM -0700, Mike Mestnik wrote:
> > iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> > iptables -A OUTPUT -m state --state NEW -j ACCEPT
> >
> I have seen this context used on BSD there it is manditory to allow
> "--state NEW"(with diffrent syntax) but "--state ESTABLISHED,RELATED" is
> silently added to another 'expected' table. I was wondering what ipfilter
> NEEDs to operate?
I think you meant iptables? It doesn't absolutely *need* the
ESTABLISHED, RELATED rule, but it won't put it in by default. So if
you are accepting NEW packets, and you do not have the ESTABLISHED,
RELATED rule, you will have to explicitly allow future traffic, in
both directions. This is the way ipchains was - you could accept some
NEW connections (TCP only - by checking the SYN flag), but had to
create bi-directional rules for traffic beyond that.
Doug
Reply to: