* TPROXY target returns NF_ACCEPT
@ 2009-06-16 9:09 Philip Craig
2009-06-17 9:20 ` KOVACS Krisztian
0 siblings, 1 reply; 2+ messages in thread
From: Philip Craig @ 2009-06-16 9:09 UTC (permalink / raw)
To: netfilter-devel; +Cc: KOVACS Krisztian
The TPROXY target returns NF_ACCEPT rather than XT_CONTINUE.
Is there a reason for this, or is it left over from when
there was a tproxy table? I can place the tproxy rules last
if needed, but this behaviour was unexpected.
Also, does tproxy handle related ICMP packets too?
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: TPROXY target returns NF_ACCEPT
2009-06-16 9:09 TPROXY target returns NF_ACCEPT Philip Craig
@ 2009-06-17 9:20 ` KOVACS Krisztian
0 siblings, 0 replies; 2+ messages in thread
From: KOVACS Krisztian @ 2009-06-17 9:20 UTC (permalink / raw)
To: Philip Craig; +Cc: netfilter-devel, KOVACS Krisztian
Hi,
On k, jún 16, 2009 at 07:09:42 +1000, Philip Craig wrote:
> The TPROXY target returns NF_ACCEPT rather than XT_CONTINUE.
> Is there a reason for this, or is it left over from when
> there was a tproxy table? I can place the tproxy rules last
> if needed, but this behaviour was unexpected.
It has more to do with the REDIRECT-like functionality of the target.
TPROXY 'redirection' is tricky, since it does not actually touch the skb
but the packet ends up in a local socket with a different address/port.
> Also, does tproxy handle related ICMP packets too?
The 'socket' match matches for related ICMP, so if you use TPROXY in
conjuction with that, then yes, it does handle related ICMP.
--
KOVACS Krisztian
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-06-17 9:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-06-16 9:09 TPROXY target returns NF_ACCEPT Philip Craig
2009-06-17 9:20 ` KOVACS Krisztian
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.