Charlie Brady wrote:
>
> On Fri, 17 Dec 1999, Del wrote:
>
> > Alexander Else wrote:
> > >
> > > How about:
> > > ipchains -A input -d $ETH0_NET -s $ALL ! -y -j ACCEPT
> > >
> > > This allows packets for already established sessions. Your LAN users will
> > > be able to establish outgoing connections still, but this rule will not
> > > match packets with SYN set.
> >
> > Fine for TCP. What about UDP/DDP/GRE/ICMP etc?
>
> UDP is a connectionless protocol. You can't distinguish at the packet
> level between query packets and reply packets.
Firewalls that employ "stateful inspection" monitor the outgoing UDP packets
and open ports based on the source ports of the packets that pass out. In
effect, this is what IP masquerade does (so it knows what box behind the masq'd
network to pass the packet back to).
I guess it's a feature request for NAT/iptables ... is Rusty on this list
anywhere?
----+------------------------+--------------------------
Del | mailto:[EMAIL PROTECTED] | Christchurch, New Zealand
----+------------------------+--------------------------
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
