Re: CARP and OUT rules
"Tonix (Antonio Nati)" <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.m0n0wall |
|---|---|
| Message-ID | <[email protected]> |
Il 08/09/2011 21:44, Anders Hagman ha scritto: > You are right, but not knowing exactly how ipfiler works here is a > thought. > The default behavior is to deny all incoming traffic and you must specify a permit rule to allow your traffic through. > Because the firewall is stateful it will create a dynamic rule to shortcut the filter table. > > so.. > > You have to do your incoming filter anyway. > Even if we do an outgoing filer does the firewall test it at all? > No, I'm quite confident you don't need any "pass in" rule. When a "pass out" rule has been accepted, it should go in a "cache" table of already accepted connections, exactly like it does now. I thing nothing else should change. Hope someone of monowall development can answer, but I'm pretty confident it will work exactly like now. If I don't go wrong, when the FW goes in checking stage, it checks in cache table if connections has already been accepted, otherwise scans the rules table. For fw there should be no difference if rule is "pass in" or "pass out". Regards, Tonino > BR > Anders > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > -- ------------------------------------------------------------ Inter@zioni Interazioni di Antonio Nati http://www.interazioni.it [email protected] ------------------------------------------------------------