Firewall

[Jeff Raber]

On 12/09/2010 09:00 PM, Curtis Doty wrote:
> Why must statefull connection tracking be imposed on every Fedora user?
>
> Don't get me wrong. I use netfilter all the time and love it. And it's 
> good to install the userland iptables tools and a simple firewall by 
> default. But when I'd like to choose Fedora without it (asymmetric 
> routing anyone?), I now have to rebuild the kernel. [harumph!]
>
> Was there ever a good reason for making the filter table and conntrack 
> modules monolithic? They certainly didn't used to be built in...
>
> ../C
Seems like there should be an easy way to 'opt-out' of connection 
tracking.  Have you tried anything like 'iptables -t raw -I PREROUTING 
-j NOTRACK' ?

The iptables man-page says this about the 'raw' table:
"  This table is used mainly for configuring exemptions from connection 
tracking in combination with the NOTRACK target.  It registers  at  the 
netfilter  hooks  with  higher  priority and is thus called before 
ip_conntrack, or any other IP tables.  It provides the following 
built-in chains: PREROUTING (for packets arriving via any network 
interface) OUTPUT (for packets generated by local processes)  "

Cheers.
-Jeff