[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: ssh connection survives reboot of stateful iptables router

Am Monday 03 July 2006 22:52 schrieb martin f krafft:
> I was surprised today to find an SSH connection from my LAN to the
> 'Net surviving a power cycle of my router -- a laptop running sarge
> with kernel 2.6 and iptables.
> I have the following two rules first thing in the FORWARD chain:
>   -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
>   -A FORWARD -m conntrack --ctstate INVALID -j DROP
> to me, this means that SYN packets may pass to the actual rules, and
> packets belonging to a connection known to the router are accepted.
> During the reboot, the router surely forgot about the existing
> connections, so why can the SSH connection persist? Is there some
> Linux magic going on?
That must be connection pickup. At
search for "pickup".

with best regards,

Gibraltar firewall       http://www.gibraltar.at/

Attachment: pgpKzCKV5kd1E.pgp
Description: PGP signature

Reply to: