* iptables-restore - does it breaks existing connections?
@ 2011-05-25 3:29 gapsf
2011-05-27 15:06 ` Erik Schorr
0 siblings, 1 reply; 5+ messages in thread
From: gapsf @ 2011-05-25 3:29 UTC (permalink / raw)
To: netfilter
For example, when (re)loading the same set of rules?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: iptables-restore - does it breaks existing connections?
2011-05-25 3:29 iptables-restore - does it breaks existing connections? gapsf
@ 2011-05-27 15:06 ` Erik Schorr
2011-05-27 15:58 ` Jan Engelhardt
0 siblings, 1 reply; 5+ messages in thread
From: Erik Schorr @ 2011-05-27 15:06 UTC (permalink / raw)
To: netfilter; +Cc: gapsf
On 05/24/2011 08:29 PM, gapsf@yandex.ru wrote:
> For example, when (re)loading the same set of rules?
When using iptables-restore or a similar method, the new table is loaded
atomically. As long as the new ruleset permits the traffic, there
should be no dropped connections (or connection states). The kernel
keeps connection state information independently of firewall rules.
The best way to explicitly guarantee that all your connections stay up
if you plan on loading a different ruleset, is to make sure there's a
rule near the top of each of your INPUT/OUTPUT/FORWARD chains that
accepts established/related connections:
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
--
Erik Schorr KD6AUT
Advocate and Consultant
VMware/Iptables/Exim/Perl
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: iptables-restore - does it breaks existing connections?
2011-05-27 15:06 ` Erik Schorr
@ 2011-05-27 15:58 ` Jan Engelhardt
2011-05-27 22:31 ` Erik Schorr
0 siblings, 1 reply; 5+ messages in thread
From: Jan Engelhardt @ 2011-05-27 15:58 UTC (permalink / raw)
To: Erik Schorr; +Cc: netfilter, gapsf
On Friday 2011-05-27 17:06, Erik Schorr wrote:
> On 05/24/2011 08:29 PM, gapsf@yandex.ru wrote:
>> For example, when (re)loading the same set of rules?
>
> When using iptables-restore or a similar method, the new table is loaded
> atomically. As long as the new ruleset permits the traffic, there should be no
> dropped connections (or connection states). The kernel keeps connection state
> information independently of firewall rules.
>
> The best way to explicitly guarantee that all your connections stay up if you
> plan on loading a different ruleset, is to make sure there's a rule near the
> top of each of your INPUT/OUTPUT/FORWARD chains that accepts
> established/related connections:
>
> iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>
Though these dates,-m conntrack --ctstate ESTABLISHED,RELATED is used.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: iptables-restore - does it breaks existing connections?
2011-05-27 15:58 ` Jan Engelhardt
@ 2011-05-27 22:31 ` Erik Schorr
2011-05-27 22:37 ` Jan Engelhardt
0 siblings, 1 reply; 5+ messages in thread
From: Erik Schorr @ 2011-05-27 22:31 UTC (permalink / raw)
To: netfilter; +Cc: Jan Engelhardt, gapsf
On 5/27/2011 8:58 AM, Jan Engelhardt wrote:
> Though these dates,-m conntrack --ctstate ESTABLISHED,RELATED is used.
Is there a practical, performance, or functional difference between
using -m state and -m conntrack?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: iptables-restore - does it breaks existing connections?
2011-05-27 22:31 ` Erik Schorr
@ 2011-05-27 22:37 ` Jan Engelhardt
0 siblings, 0 replies; 5+ messages in thread
From: Jan Engelhardt @ 2011-05-27 22:37 UTC (permalink / raw)
To: Erik Schorr; +Cc: netfilter, gapsf
On Saturday 2011-05-28 00:31, Erik Schorr wrote:
> On 5/27/2011 8:58 AM, Jan Engelhardt wrote:
>> Though these dates,-m conntrack --ctstate ESTABLISHED,RELATED is used.
>
> Is there a practical, performance, or functional difference between using -m
> state and -m conntrack?
It has many more checks available; perhaps the second most handy (to me,
at least) one after the usual EST/REL clause is --ctstate DNAT.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-05-27 22:37 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-05-25 3:29 iptables-restore - does it breaks existing connections? gapsf
2011-05-27 15:06 ` Erik Schorr
2011-05-27 15:58 ` Jan Engelhardt
2011-05-27 22:31 ` Erik Schorr
2011-05-27 22:37 ` Jan Engelhardt
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.