On Sun, May 19, 2013 at 11:48:17AM -0400, Nick Khamis wrote: > We do use a statefull iptables on our router, some forward rules... > This is known to be on of our issues, not sure if having a separate > iptables box would be the best and only solution for this? Do you actually need stateful filtering? A lot of people seem to think that it's important, when really they're accomplishing little from it, you can block ports etc without it. And the idea of protecting hosts from strange traffic is only really significant if the hosts have very outdated TCP/IP stacks etc. And it breaks things like having multiple routers.
There's an obscure NOTRACK rule you can use to cut down the number of state entries, or remote state tracking for hosts that don't need it. http://serverfault.com/questions/234560/how-to-turn-iptables-stateless although googling for NOTRACK should find other things too. Ben.