Re: Is the article "Secure use of iptables and connection tracking helpers" (by Pablo et al.) still relevant?

On 17.06.2026 12:29, Binarus wrote:
> [...]
>
> For example, the nf_conntrack module in modern kernels (e.g., 6.12.90 on my Debian trixie system) obviously does not have the "nf_conntrack_helper" parameter the article mentions. Hence, setting it to 0 does not effect anything. Setting the "port" parameter to 0 seems to do the trick, though.

Setting the "port" parameter to 0 does not do the trick, too. Sorry for the wrong statement. I had interpreted a test result in a wrong way.

> 
> Background: If finally have upgraded my firewall from iptables to nftables (and have learned a lot in doing so). Now I'd like to improve security further by applying the recommendations from that article to the nf_conntrack_sip helper module (I have an asterisk instance running on my local network that communicates with the internet / the telephony providers via NAT, so I have to use the conntrack sip helper to make telephony work).
> 
> In other words, I' like to know whether we should still prevent the automatic loading of the nf_conntrack_sip module, and how we can achieve that.
> 
> Thank you very in advance, and best regards,
> 
> Binarus
> 
>