iptables leaking blocked ip addresses.
kadlec at blackhole.kfki.hu
Wed Jun 22 09:10:46 CEST 2005
On Tue, 21 Jun 2005, Jan Engelhardt wrote:
> >NOTRACK is valid in the raw table alone. If you want a generic "NOTRACK
> >and TARPIT everything which is not allowed", then that I think won't go.
> Would it work to have a -t filter-capable NOTRACK target?
No, that'd be too late, the packet were already be tracked by then.
Everything which is not marked by NOTRACK in the raw table, before
conntrack, will enter conntrack.
E-mail : kadlec at blackhole.kfki.hu, kadlec at sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
More information about the netfilter