Re: [Nufw-users] nufw in production environments

[Vincent Deffontaines]

Javier de Miguel Rodríguez said:
>
>
> One tip... that ONLYworks with tcp. If you use -m state --state NEW to
> QUEUE all protocols should work,
> not only tcp... or am i missing something?
>

Well, conceptually you are 100% right.
However, right now, only TCP is supported.
Why is that? This is a problem on client side.

TCP is easy to track : when a SYN packet has been sent, you just need to
look into the kernel's tables to check for it.

How about UDP? It is much tricker (but still possible) to follow on client
side, due to UDP being stateless.

ICMP is even harder
Other protocols we have not investigated yet.

Hope this is clear enough :)

So, practically, only TCP can be authenticated at this time.

Vincent