iptables leaking blocked ip addresses.

[Jozsef Kadlecsik]

On Tue, 21 Jun 2005, Jan Engelhardt wrote:

>
> >NOTRACK is valid in the raw table alone. If you want a generic "NOTRACK
> >and TARPIT everything which is not allowed", then that I think won't go.
>
> Would it work to have a -t filter-capable NOTRACK target?

No, that'd be too late, the packet were already be tracked by then.
Everything which is not marked by NOTRACK in the raw table, before
conntrack, will enter conntrack.

Best regards,
Jozsef
-
E-mail  : kadlec at blackhole.kfki.hu, kadlec at sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary