I do have such a rule at the top of the rule set. Sorry I did not provide more context. The basic structure of my rule set is:
1. Deny some known bad packet types. 2. Accept ESTABLISHED, RELATED traffic. 3. Accept rules of various sorts (such as the memcached rules). 4. Deny all (catch all rule).
I'm not an iptables newbie - I have used it for years and understand its basic operation. All my other rules work perfectly. This is why I am perplexed as to the memcached rules not working as expected and why I suspect a bug of some sort.
Thanks,
Sam
On Sat, Dec 13, 2008 at 7:14 AM, Filipe Brandenburger filbranden@gmail.com wrote:
Hi,
On Fri, Dec 12, 2008 at 18:28, Art Age Software artagesw@gmail.com wrote:
IPTABLES -A INPUT -i bond0 -p tcp -m tcp -s 192.168.1.0/24 -d 192.168.1.0/24 --dport 11211 -m state --state NEW -j ACCEPT
s1 kernel: DROP -- Catch All: IN=bond0 OUT= SRC=192.168.1.2 DST=192.168.1.1 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=6467 DF PROTO=TCP SPT=51837 DPT=11211 WINDOW=202 RES=0x00 ACK FIN URGP=0
To use stateful rules, you must have rules for state ESTABLISHED too, otherwise it will only allow the first packet and not the all others. The first rule should always be:
iptables -A ... -i bond0 -m state --state ESTABLISHED,RELATED -j ACCEPT
That's the point of stateful rules, you match the rules further down for new connections, but existing connections will always match the first rule.
You should google for "iptables stateful" and try to get a better explanation of what it is and how it works.
HTH, Filipe _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos