conntrack module question?
Hi,
I am using conntrack module for a while. As suggested configuration I do add ;
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate INVALID -j DROP
At the top of the configuration. After that I added the drop rule as;
-A FORWARD -i eth0 -o eth1 -m set --match-set STOPALL src -j DROP
This rule is not statefull and should drop everything. I added an IP address, 174.142.179.235 a SPAMMER, to stop its communication. But it did no stop. As far as I know in TCP connection the packets is not in ESTABLISHED state but could be RELATED :(.
I wrote "drop everything from STOPALL list", but the connection is not dropped. If I wrote the the DROP statement above the 1st rule, it will drop all the connection. What is wrong? I do not want to write DROP statement to the top?
Thanks.
begin:vcard
fn:Husnu Demir
n:Demir;Husnu
email;internet:[email protected]
tel;work:+903122103330
tel;fax:+903122103303
x-mozilla-html:FALSE
version:2.1
end:vcard
Quoted 8 lines · Husnu Demir
Hi,
I am using conntrack module for a while. As suggested configuration I do add ;
(quoted diff) +0
-2-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate INVALID -j DROP
Quoted 6 lines
At the top of the configuration. After that I added the drop rule as;
-A FORWARD -i eth0 -o eth1 -m set --match-set STOPALL src -j DROP
I added an IP address,
174.142.179.235 a SPAMMER, to stop its communication. But it did no stop.
How are you determining this?
Quoted 1 line
I wrote "drop everything from STOPALL list", but the connection is not dropped.
It drops packets, not connections.
Quoted 3 lines
If
I wrote the the DROP statement above the 1st rule, it will drop all the connection. What is wrong?
Perhaps nothing. You clearly accept established connections first, so only new ones will be ignored. It does not change existing ones.
Quoted 1 line
I do not want to write DROP statement to the top?
Do you?
Quoted 10 lines · Jan Engelhardt
Quoted 8 lines · Husnu Demir
Hi,
I am using conntrack module for a while. As suggested configuration I do add ;
(quoted diff) +0
-2-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m conntrack --ctstate INVALID -j DROP
Quoted 8 lines
Quoted 6 lines
At the top of the configuration. After that I added the drop rule as;
-A FORWARD -i eth0 -o eth1 -m set --match-set STOPALL src -j DROP
I added an IP address,
174.142.179.235 a SPAMMER, to stop its communication. But it did no stop.How are you determining this?
In fact this address collecting passwords from a hacked site and I want tot stop it. It is an HTTP connection. And If I put this IP to the list I coud connect the web site. But if I put the rule above the first rule I could not connect.
http://www.formchamp.com/form.php?id=1120
is the actual SCAM site.
Quoted 4 lines
Quoted 2 lines
I wrote "drop everything from STOPALL list", but the connection is not dropped.
It drops packets, not connections.
But if it cannot send any packets how a connection can be established?
Quoted 11 lines
Quoted 4 lines
If
I wrote the the DROP statement above the 1st rule, it will drop all the connection. What is wrong?Perhaps nothing. You clearly accept established connections first, so only new ones will be ignored. It does not change existing ones.
Quoted 1 line
I do not want to write DROP statement to the top?
Do you?
In fact my all drop statements are at the top accept first one. I had some different issues when I wrote it below. It seems better for me to keep it at the top. Perpahps I should re-consider it.
thanks.
hdemir.
begin:vcard
fn:Husnu Demir
n:Demir;Husnu
email;internet:[email protected]
tel;work:+903122103330
tel;fax:+903122103303
x-mozilla-html:FALSE
version:2.1
end:vcard