On Fri, 17 Dec 1999, Del wrote: > Alexander Else wrote: > > > > How about: > > ipchains -A input -d $ETH0_NET -s $ALL ! -y -j ACCEPT > > > > This allows packets for already established sessions. Your LAN users will > > be able to establish outgoing connections still, but this rule will not > > match packets with SYN set. > > Fine for TCP. What about UDP/DDP/GRE/ICMP etc? UDP is a connectionless protocol. You can't distinguish at the packet level between query packets and reply packets. Charlie Brady Aurema Pty Ltd PO Box 305, Strawberry Hills, NSW 2012, Australia Email:[EMAIL PROTECTED], Tel: +61 2 9698 2322, Fax: +61 2 9699 9174 "I think it would be a good idea." Ghandi, on Western Civilisation. -- SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au To unsubscribe send email to [EMAIL PROTECTED] with unsubscribe in the text
