Re: Connection tracking and vlan
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2009-10-30 16:54:58
On Fri, Oct 30, 2009 at 05:19:30PM +0100, Eric Dumazet wrote:
No, Abayadi needs firewall rules (or RPF), before entering conntrack.
rp_filter doesn't help because routing occurs after conntrack, so IP fragments from the untrusted side may have already been folded into a fragment from the trusted side. Yes netfilter rules pre-conntrack would help but I bet there are a lot folks out there who don't have them. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} [off-list ref] Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt