conntrack/state with QUEUE target
Quoted 14 lines · Udo Schneider
All,
Quoted 4 lines
This worked fine. Now however we have the requirement for more granular "stateful" Rules. I though it should be possible to combine state/conntrack with the QUEUE target ... but this doesn't seem to work.
-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j QUEUE
I think I got it.
-t mangle -A FORWARD -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j QUEUE
(quoted diff) +0
-2-t mangle -A FORWARD -p tcp --sport 80 -m state --state ESTABLISHED -j QUEUE
Quoted 4 lines
This combination seems to work. Coming from a Check Point Background I assumed that the statefulness provided by state/conntrack means that I only have to specify the initiating connection - replies are accepted/queued automagically based on connection data.
However I seem to be wrong - or did I completely miss the point?
Hello,
the connection tracking itself will never do anything with a packet, than tracking it. What is done with the state information, that is put onto the packet, is totally up to the user. NO automagic is done.
i.e. what if you don't want replies in your queue, etc...
Also take care about state 'INVALID' and 'UNTRACKED' packets, your queue will not see them...
btw: NFQUEUE is the successor of QUEUE.
Regards
Mart