newsIPQ BDB filter - News

 
 

Released v1.03

Item posted by Alessandro Vesely <ale2003> on Thu 10 Mar 2011 06:44:09 PM UTC.

Changes and new features:





exec-connkill


When this option is given, if an updated address reaches 100% block probability then an external command is invoked.  The command is to be configured in a new configuration file, and presumably kills any established connection.  Using "conntrack -D" seems to work well, as it allows the stateful firewall to thereafter detect extraneous packets on its own.

This is more efficient than filtering each output packet in order to mark unwanted ones, as it doesn't imply queuing to user space. The two methods are not exactly equivalent, but they can be used concurrently.

Back to the top

Powered by Savane 3.13-02a9.
Corresponding source code