state match support in ip6tables
hi all, i need help with ip6tables and match support
can i use it with vannilla2.4?
where can i get a patch to enable the it (evenif there's one)?
tnx
Quoted 4 lines · marco
hi all, i need help with ip6tables and match support
can i use it with vannilla2.4?
where can i get a patch to enable the it (evenif there's one)?
Conntection tracking isn't implemented in ipv6 AFSIK.
Quoted 5 lines
tnx
this mean i cannot set my input policy to drop, or i'll kill all my ack packets, right?
Il ven, 2004-03-12 alle 00:30, Alexander Samad ha scritto:
Quoted 13 lines · marco
Quoted 4 lines
hi all, i need help with ip6tables and match support
can i use it with vannilla2.4?
where can i get a patch to enable the it (evenif there's one)?Conntection tracking isn't implemented in ipv6 AFSIK.
Quoted 5 lines
tnx
Quoted 2 lines · marco
this mean i cannot set my input policy to drop, or i'll kill all my ack packets, right?
What it means is that you can't use -match state so you don't have access to the NEW, ESTABLISH or RELATED
You can still check on all the ip flags
Alex
Quoted 18 lines
Il ven, 2004-03-12 alle 00:30, Alexander Samad ha scritto:
Quoted 13 lines · marco
Quoted 4 lines
hi all, i need help with ip6tables and match support
can i use it with vannilla2.4?
where can i get a patch to enable the it (evenif there's one)?Conntection tracking isn't implemented in ipv6 AFSIK.
Quoted 5 lines
tnx
Quoted 1 line · Alexander Samad
You can still check on all the ip flags
s/ip/tcp
Signature · 2 lines
http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 2 lines
Quoted 2 lines
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!
A message that is not in the archive (sent off-list or not yet received): [email protected].
net
iptables query
hello,
i had another question ... i need a method to do one of the following 2 choices -
1. I receive a packet of an interface and apply source nat but i also need to change the destination address!
or
2. I receive the packet and send it over a tunnel interface (based on the destination address) but i also need to change the destination address ( the ROUTE patch allows me direct the packet to the tunnel interface based on the dest address but how do i change this address before it is sent to the tunnel interface) ....also if i have multiple tunnel interfaces as options for one destination address - can i achieve a round robin kind of usage between them?
Thanks,
Hitesh
Alexander Samad [2004-03-12 00:30 CET]:
Quoted 7 lines · marco
Quoted 4 lines
hi all, i need help with ip6tables and match support
can i use it with vannilla2.4?
where can i get a patch to enable the it (evenif there's one)?Conntection tracking isn't implemented in ipv6 AFSIK.
Do you know. why this isn't implemented yet?
Are there technical reasons or only a problem of priorities?
I would like to have IPv6 statefull inspection, because i and some others want to play with IPV6 over freenet6. But making firewall rules w/o statefull inspection isn't really funny, nor is it compareable.
Frank.
Signature · 3 lines
Frank Matthieß [x] Nail here for new monitor.
Quoted 11 lines · Frank Matthie?
Alexander Samad [2004-03-12 00:30 CET]:
Quoted 7 lines · marco
Quoted 4 lines
hi all, i need help with ip6tables and match support
can i use it with vannilla2.4?
where can i get a patch to enable the it (evenif there's one)?Conntection tracking isn't implemented in ipv6 AFSIK.
Do you know. why this isn't implemented yet?
Are there technical reasons or only a problem of priorities?
No, I don't know, only passing on what I have read in the dev mailing list.
Quoted 4 lines
I would like to have IPv6 statefull inspection, because i and some others want to play with IPV6 over freenet6. But making firewall rules w/o statefull inspection isn't really funny, nor is it compareable.
agreed
Quoted 6 lines
Frank.
Signature · 3 lines
Frank Matthie? [x] Nail here for new monitor.
Quoted 3 lines · Frank Matthieß
Quoted 1 line
Conntection tracking isn't implemented in ipv6 AFSIK.
Do you know. why this isn't implemented yet?
Are there technical reasons or only a problem of priorities?
Dev team wants to achieve a layer 3 independant framework with associated conntrack, so they do not have to duplicate code between IPv4 and IPv6. Tools will be called pkttables. In the meantime, stuff like POM-ng (for 2.6) or nfnetlink/ctnetlink seems to have been prioritorized. I am no developper, so I give you my understanding of the situation, which can be a complete misundestanding :)
However, Yasuyuki Kozakai from USAGI project posted a couple of patches to add IPv6 conntrack to Netfilter. Just crawle dev mailing list archives and you will find it quick.
Quoted 3 lines
I would like to have IPv6 statefull inspection, because i and some others want to play with IPV6 over freenet6. But making firewall rules w/o statefull inspection isn't really funny, nor is it compareable.
Use Yasuyuki patch if it works fine for you (never tested it), or use BSD pf while waiting for official pkttables release.
Signature · 2 lines
http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 2 lines
Quoted 2 lines
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!