Many years ago, I understood IPCHAINS, and the first versions of IPTABLES. However, IPTABLES has followed the example of Larry Wall's Practical Extraction and Reporting Language and turned into a pseudo-OS that I barely comprehend. Some rules that I added many years ago were designed to reject unsolicited connection attempts (after whitelisting my small LAN)...
-A ICMP_IN -p icmp -m state -j UNSOLICITED -A TCP_IN -p tcp -m state -m tcp -j UNSOLICITED -A UDP_IN -p udp -m state -j UNSOLICITED Now these all give me the error message... WARNING: The state match is obsolete. Use conntrack instead. iptables-restore v1.4.16.3: state: option "--state" must be specified "man iptables" suggested "man iptables-extensions". As near as I can tell, the "new and improved" way is... -A ICMP_IN -p icmp -m conntrack --ctstate INVALID -j UNSOLICITED -A TCP_IN -p tcp -m conntrack --ctstate INVALID -m tcp -j UNSOLICITED -A UDP_IN -p udp -m conntrack --ctstate INVALID -j UNSOLICITED This appears to work, i.e. it doesn't cause iptables to fail. Does this do what I think it does (reject unsolicited connections)? The reason that I'm asking is because I'm simply not sure. -- Walter Dnes <waltd...@waltdnes.org> I don't run "desktop environments"; I run useful applications
