diff options
author | Tan Hu <tan.hu@zte.com.cn> | 2018-09-07 11:33:33 +0300 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-09-28 15:28:26 +0300 |
commit | 097f95d319f817e651bd51f8846aced92a55a6a1 (patch) | |
tree | 0ee53a38d23a3c3eb02be0b671359305335e10a9 /net/netfilter | |
parent | 9306425b70bf1284a037b7461222887aff48cf8d (diff) | |
download | linux-097f95d319f817e651bd51f8846aced92a55a6a1.tar.xz |
netfilter: masquerade: don't flush all conntracks if only one address deleted on device
We configured iptables as below, which only allowed incoming data on
established connections:
iptables -t mangle -A PREROUTING -m state --state ESTABLISHED -j ACCEPT
iptables -t mangle -P PREROUTING DROP
When deleting a secondary address, current masquerade implements would
flush all conntracks on this device. All the established connections on
primary address also be deleted, then subsequent incoming data on the
connections would be dropped wrongly because it was identified as NEW
connection.
So when an address was delete, it should only flush connections related
with the address.
Signed-off-by: Tan Hu <tan.hu@zte.com.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
0 files changed, 0 insertions, 0 deletions