summaryrefslogtreecommitdiff
path: root/doc
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2010-05-10 01:10:09 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2010-05-10 01:10:09 +0200
commit7a12625004d261bcd292a75b036522f12840c027 (patch)
tree2a7b084887ef9ba9f0a65beeb453a00371b0f731 /doc
parent58b363d32bf9b8b504c5664ae4d8b3bb1fab6ddb (diff)
downloadconntrack-tools-7a12625004d261bcd292a75b036522f12840c027.tar.gz
conntrack-tools-7a12625004d261bcd292a75b036522f12840c027.zip
doc: description on how to block traffic with conntrack was incomplete
This patch completes the documentation with the following discussion that took place in the mailing list. http://marc.info/?l=netfilter&m=127335152521674&w=2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc')
-rw-r--r--doc/manual/conntrack-tools.tmpl9
1 files changed, 7 insertions, 2 deletions
diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl
index b897318..c3e8682 100644
--- a/doc/manual/conntrack-tools.tmpl
+++ b/doc/manual/conntrack-tools.tmpl
@@ -19,7 +19,7 @@
</authorgroup>
<copyright>
- <year>2008</year>
+ <year>2008-2010</year>
<holder>Pablo Neira Ayuso</holder>
</copyright>
@@ -198,7 +198,12 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries have been shown.
conntrack v0.9.7 (conntrack-tools): 1 flow entries has been updated.
</programlisting>
-<para>Delete one entry, this can be used to block traffic (you have to set <emphasis>/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal</emphasis> to zero).</para>
+<para>Delete one entry, this can be used to block traffic if:</para>
+<itemizedlist>
+ <listitem><para>You have a stateful rule-set that blocks traffic in INVALID state.</para></listitem>
+ <listitem><para>You have set <emphasis>/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose</emphasis> or <emphasis>/proc/sys/net/netfilter/nf_conntrack_tcp_loose</emphasis>, depending on your kernel version, to zero.</para></listitem>
+</itemizedlist>
+
<programlisting>
# conntrack -D -p tcp --dport 3486
tcp 6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=1 secmark=0 use=1