Re: DNS replies not RELATED/ESTABLISHED?

[Phil Dyer <phil.dyer@cox.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

martin f krafft said:

> 
> Here are the relevant rules:
> 
>   -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>   -A INPUT -m conntrack --ctstate INVALID -j DROP
> 
>   -A INPUT -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[INPUT]: "
> 
>   -P INPUT DROP

for INPUT, lose the conntrack.
- -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


- --

/phil


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (MingW32)
Comment: Public Key: http://www.dyermaker.org/gpgkey

iD8DBQFCNu08Gbd/rBLcaFwRAji0AJ0cwYWcRPji9AFpsJzHr+Dr0OIAbwCeJGej
RfAAkcC+CCg3lgOGKKHl7GA=
=l8Ym
-----END PGP SIGNATURE-----