Larry Menten wrote: >There must be a way to distinguish locally originated/terminated traffic. > >Linux provides hooks (NF_*_LOCAL_IN/OUT) for locally originated/terminated >traffic that supports this nicely. Without such a hook it is difficult to >protect the firewall host with a more restrictive policy than fused for routed >traffic. > >Solaris pfh does provide NH_FORWARDING, but the feature needs NH_LOCAL_IN and >NH_LOCAL_OUT as well. > >Have I overlooked something? > >
No, we have only designed it in accordance with what people need. At the time it was designed and developed, there was no requirement for LOCAL_IN or LOCAL_OUT. At present determining whether or not traffic has originated from the host (or is destined for it) should be a result of looking more deeply at packet headers. Darren _______________________________________________ networking-discuss mailing list [email protected]
