diff options
| author | Simon Ruderich <simon@ruderich.org> | 2021-03-07 10:51:35 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-03-09 02:41:59 +0100 |
| commit | 95141d17efe22e66aca85e0cc53a5a6d6bc1f3cd (patch) | |
| tree | c51516ab47cfdc3d803f335e7d778bcd09f6776c /doc | |
| parent | 29ca1ad33a8b82e7d51e9581359f17fec44b376e (diff) | |
doc: remove duplicate tables in synproxy example
The "outcome ruleset" is the same as the two tables in the example.
Don't duplicate this information which just wastes space in the
documentation and can confuse the reader (it took me a while to realize
the tables are the same).
In addition, use the same table name for both tables to make it clear
that they can be the same. They will be merged in the resulting ruleset.
Signed-off-by: Simon Ruderich <simon@ruderich.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/statements.txt | 17 |
1 files changed, 1 insertions, 16 deletions
diff --git a/doc/statements.txt b/doc/statements.txt index aac7c7d6..7bb538a9 100644 --- a/doc/statements.txt +++ b/doc/statements.txt @@ -567,28 +567,13 @@ drop incorrect cookies. Flags combinations not expected during 3WHS will not match and continue (e.g. SYN+FIN, SYN+ACK). Finally, drop invalid packets, this will be out-of-flow packets that were not matched by SYNPROXY. - table ip foo { + table ip x { chain z { type filter hook input priority filter; policy accept; ct state { invalid, untracked } synproxy mss 1460 wscale 9 timestamp sack-perm ct state invalid drop } } - -The outcome ruleset of the steps above should be similar to the one below. - - table ip x { - chain y { - type filter hook prerouting priority raw; policy accept; - tcp flags syn notrack - } - - chain z { - type filter hook input priority filter; policy accept; - ct state { invalid, untracked } synproxy mss 1460 wscale 9 timestamp sack-perm - ct state invalid drop - } - } --------------------------------------- FLOW STATEMENT |