On 06/03/2011 07:00 AM, Tom Eastep wrote: > It's perfectly safe to add to a system on which Shorewall was started at > boot. I run with a 'dropInvalid net all' rule on my own firewall > (it's the first entry in my rules file). On Debian, at least, the > default setting of /proc/sys/net/netfilter/nf_conntrack_tcp_loose is > '1', so all->net INVALID state packets will create a conntrack entry > which will then match incoming packets that are part of the same > connection. That is the principle of 'connection pickup'. Note that > stream-oriented protocols like TCP are the only ones where 'INVALID' > state can occur; it cannot occur on datagram-oriented protocols like UDP.
One other thing that I should mention is that I have this in my /etc/shorewall/init file: echo 1 > /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal That turns off Netfilter's window tracking feature which seems to continually have issues with correctly classifying packets. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Simplify data backup and recovery for your virtual environment with vRanger. Installation's a snap, and flexible recovery options mean your data is safe, secure and there when you need it. Discover what all the cheering's about. Get your free trial download today. http://p.sf.net/sfu/quest-dev2dev2
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
