[175021] in North American Network Operators' Group
RE: netfilter/iptables synproxy; need help deciding
daemon@ATHENA.MIT.EDU (Thijs Stuurman)
Wed Oct 8 11:06:36 2014
X-Original-To: nanog@nanog.org
From: Thijs Stuurman <Thijs.Stuurman@is.nl>
To: Nanog <nanog@nanog.org>
Date: Wed, 8 Oct 2014 15:06:26 +0000
In-Reply-To: <CACF2tH9BkLwn7J5VSCg_HcqXNqAC6Rh1g-mS57RSDbTcROZiYA@mail.gmail.com>
Errors-To: nanog-bounces@nanog.org
SSBzZXQgdXAgYSBicmlkZ2UgYXQgaG9tZSB0byBmaWx0ZXIgdHJhZmZpYyB1c2luZyBpcHRhYmxl
cyB3aXRoIHN5bnByb3h5LiBJIHRyaWVkIHRvIGFkanVzdCB0aGUgbGluZXMgc28gdGhhdCBpdCB3
b3VsZCBsb2cgaGl0cyBidXQgdGhhdCB3b3VsZG4ndCB3b3JrDQpJdCBnYXZlIG1lIGEgbWVzc2Fn
ZSB0byByZWFkIGRtZXNnIHdoeSBpdCBkaWRuJ3Qgd29yayBidXQgZG1lc2cgaGFkIG5vIGluZm9y
bWF0aW9uIGluIGl0Lg0KSG93ZXZlciwgd2hlbiBJIHR1cm5lZCBvbiB0aGUgbGluZXMgaW4gbXkg
aXB0YWJsZXMgY29uZmlndXJhdGlvbiBmaWxlIChiYXNoIHNjcmlwdCB0byBsb2FkIGluIHRoZSBy
dWxlcyBiYXNpY2x5KSBpdCBkaWQgZmlsdGVyIG91dCBhIFNZTiBhdHRhY2sgYW5kIHRoZSBvdXRw
dXQgb2YgImNhdCAvcHJvYy9uZXQvc3RhdC9zeW5wcm94eSIgc2hvd2VkIHRoZSBzeW5fcmVjZWl2
ZWQgZ28gdXAuIChzZWUgaHR0cHM6Ly9yMDB0LXNlcnZpY2VzLm5ldC9rbm93bGVkZ2ViYXNlLzE0
L0hvbWVtYWRlLUREb1MtUHJvdGVjdGlvbi1Vc2luZy1JUFRhYmxlcy1TWU5QUk9YWS5odG1sKQ0K
DQpBIHRjcGR1bXAgb24gdGhlIGJyaWRnZSBjb25maXJtZWQgdGhlIHBhY2tldHMgY29taW5nIGlu
IGFuZCBvbiBteSBzZXJ2ZXIgYmVoaW5kIGl0IHRoZXkgZGlkbid0IHNvIHRoYXQgd29ya2VkIHdo
aWxlIEkgd291bGQgcGVyZmVjdGx5IGZpbmUgYWNjZXNzIHRoZSBhcGFjaGUgc2VydmljZS4NCg0K
DQpJIGhhdmVuJ3QgZG9uZSBhbnkgZnVydGhlciB0ZXN0aW5nLCBqdXN0IGdvdCB0aGUgc2V0dXAg
dG8gd29yayBsYXRlIGxhc3QgbmlnaHQuDQoNCg0KS2luZCByZWdhcmRzIC8gVnJpZW5kZWxpamtl
IGdyb2V0LA0KSVMgR3JvdXANClRoaWpzIFN0dXVybWFuDQoNClBvd2VyZWQgYnkgcmVzdWx0cy4N
Cg0KV2llbGluZ2Vuc3RyYWF0IDggfCBUICszMSAoMCkyOTkgNDc2IDE4NQ0KMTQ0MSBaUiBQdXJt
ZXJlbmQgfCBGICszMSAoMCkyOTkgNDc2IDI4OA0KaHR0cDovL3d3dy5pcy5ubCB8IEt2SyBIb29y
biAzNjA0OTI1Ng0KDQpJUyBHcm91cCBpcyBJU08gOTAwMToyMDA4LCBJU08vSUVDIDI3MDAxOjIw
MDUsDQpJU08gMjAuMDAwLTE6MjAwNSwgSVNBRSAzNDAyIGVuIFBDSSBEU1MgY2VydGlmaWVkLg0K
DQotLS0tLU9vcnNwcm9ua2VsaWprIGJlcmljaHQtLS0tLQ0KVmFuOiBOQU5PRyBbbWFpbHRvOm5h
bm9nLWJvdW5jZXNAbmFub2cub3JnXSBOYW1lbnMgUGFpZ2UgVGhvbXBzb24NClZlcnpvbmRlbjog
V2VkbmVzZGF5LCBPY3RvYmVyIDgsIDIwMTQgNDo1MSBQTQ0KQWFuOiBOYW5vZw0KT25kZXJ3ZXJw
OiBuZXRmaWx0ZXIvaXB0YWJsZXMgc3lucHJveHk7IG5lZWQgaGVscCBkZWNpZGluZw0KDQpIaSwN
Cg0KSSBndWVzcyBzeW5jb29raWVzIHdhc24ndCBlbm91Z2ggYW5kIHRoZSBTWU5QUk9YWSB0YXJn
ZXQgaXMgYSByZWxhdGl2ZWx5IG5ldyBhZGRpdGlvbiB0byBuZXRmaWx0ZXIuIElmIEkgcmVtZW1i
ZXIgY29ycmVjdGx5IHRoaXMgaGFzIGJlZW4gYSBwYXJ0IG9mIEJTRCBQRiBmb3IgcXVpdGUgc29t
ZSB0aW1lIGFuZCBpcyBwcmV0dHkgZWFzeSB0byBnZXQgdXAgYW5kIHdvcmtpbmcuDQpJIHJlY2Vu
dGx5IHRyaWVkIHRvIHNldCB0aGlzIHVwIG9uIG9uZSBvZiBteSBnYXRld2F5cyBjb25zaWRlcmlu
ZyB0aGF0IGl0J3MganVzdCBvbmUgbGVzcyB1bmNvdmVyZWQgbWVhbnMgZm9yIHNvbWVib2R5IHRv
IGJlIGEgZGljayB0aGF0IEkgaGF2ZSB0byBkZWFsIHdpdGggaW4gdGhlIGZ1dHVyZS4gQnV0LCBh
ZnRlciBzcGVuZGluZyBzb21lIHRpbWUgcmVzZWFyY2hpbmcgYW5kIGFza2luZyBvbiBGcmVlbm9k
ZSBJIGhhdmUgYmVlbiB1bmFibGUgdG8gZGV0ZXJtaW5lIHdoZXRoZXIgb3Igbm90IGl0IHdvcmtz
LCBvciBldmVuIG1ha2VzIGFueSBzZW5zZS4gSSdtIHN0YXJ0aW5nIHRvIHRoaW5rIGl0J3MgYSBt
b290IHBvaW50Lg0KcGFzdGllLm9yZy9wcml2YXRlL2dqc3lweGtwanM4a3VldjB0bGJ4cncjMjIg
KGlwdGFibGVzIHJ1bGVzLCBwbGVudHkgb2YgdGhpbmdzIHRvIHBpY2sgYXQgYnV0IHBsZWFzZSB0
cnkgdG8gZm9jdXMgb24gdGhlIHN1YmplY3Qgb2Ygc3lucHJveHkgZm9yIHRoZSBwdXJwb3NlIG9m
IHRoaXMgZS1tYWlsLikNCg0KYmFzZWQgb24gdGhlIGZvbGxvd2luZyB0YWJsZSBJIHdhbnQgdG8g
c2F5IGl0cyBub3Qgd29ya2luZyBiZWNhdXNlIGl0IHNlZW1zIHRvIG5ldmVyIGNoYW5nZToNCmh0
dHA6Ly9wYXN0aWUub3JnL3ByaXZhdGUveHdjdDVvcGJiMGFhamNrbzJ0bnB3DQoNCm1vcmUgaW5m
byBvbiAvcHJvYy9zdGF0L3N5bnByb3h5Omh0dHA6Ly93d3cuc3Bpbmljcy5uZXQvbGlzdHMvbmV0
ZGV2L21zZzI2NDM1MC5odG1sDQoNCk15IG9ubHkgZ3Vlc3MgaXMgdGhhdCB5b3UgY2FuJ3QgZG8g
dGhpcyBhdCBhbGwgd2l0aCBOQVQgYmVjYXVzZSBpdCByZWxpZXMgb24gY29ubnRyYWNrIG9yIG1h
eWJlIGl0IHdpbGwgb25seSB3b3JrIHdpdGggU05BVD8gSSBkb24ndCB1bmRlcnN0YW5kIHRoaXMg
d2VsbCBlbm91Z2ggdG8gc2F5OyBhcmUgcHJvcGVyIGZpcmV3YWxsIHJ1bGVzIHJlYWxseSBhIHNj
aWVuY2UgdGhhdCBuZWVkIHRvIGJlIHVuZGVyc3Rvb2QgdGhhdCBmYXIgaW4gZGVwdGg/IFdoeSBp
cyB0aGlzIG5vdCBkb2N1bWVudGVkPyBUaGlzIHR1dG9yaWFsIHNlZW1zIHRvIGluZGljYXRlIHRo
YXQgeW91IGNvdWxkIHVzZSB0aGlzIHdpdGggYSBOQVQnZCBuZXR3b3JrOg0KaHR0cDovL3d3dy5h
Y2FkZW1pYS5lZHUvNjc3Mzk4OS9Ib21lbWFkZV9ERG9TX1Byb3RlY3Rpb25fVXNpbmdfSVBUYWJs
ZXNfU1lOUFJPWFkNCg0KSSByZWFsbHkgd291bGQgbGlrZSB0byBjb21lIHRvIHNvbWUgY2xvc3Vy
ZSBvbiB0aGlzIHN1YmplY3QuIFdoZXRoZXIgaXQgbmVlZHMgdG8gYmUgZG9uZSByaWdodCBvciBu
b3QgZG9uZSBhdCBhbGwsIEknbSB0aXJlZCBvZiBpdCBsb29taW5nIG92ZXIgbWUuIEkgcmVhbGx5
IHdhbnQgdG8gYmVsaWV2ZSBJIHNob3VsZCBkbyB0aGUgdmVyeSBiZXN0IHRvIGhhdmUgYWxsIG1p
dGlnYXRpb24gdGVjaG5pcXVlcyBhbHJlYWR5IGluIHBsYWNlLCBidXQgSSdtIGhhdmluZyBhIGhh
cmQgdGltZSB1bmRlcnN0YW5kaW5nIHdoeSB0aGlzIGlzIG5leHQgdG8gaW1wb3NzaWJsZSB0byBm
aWd1cmUgb3V0IGlmIGl0J3Mgc28gaW1wb3J0YW50LiAjbmV0ZmlsdGVyIG9uIGZyZWVub2RlIGlz
IG5leHQgdG8gbm8gaGVscCwgdGhlIG1haWxpbmcgbGlzdCBzZWVtcyB0byBiZSB1bmF2YWlsYWJs
ZS4uLi4gdGhlIHRoaW5ncyBwZW9wbGUgYXJlIHNheWluZyBhYm91dCBob3cgSSBzaG91bGQgImp1
c3Qgc3dpdGNoIiBiYWNrIHRvIHVzaW5nIHBmIHNlZW0gbGlrZSBhIGRyYXN0aWMgc29sdXRpb24g
d2hlbiBwZW9wbGUgaW4gI25ldGZpbHRlciBhcmUgc28gY29udGVudCAoeWV0IG1hbnkgb2YgdGhl
bSBoYXZlIG5ldmVyIGhlYXJkIG9mIHN5bnByb3h5IGJlZm9yZS4pDQoNCg0KQW55IHRob3VnaHRz
IG9uIHRoaXMgYXJlIGFwcHJlY2lhdGVkLA0KDQotUGFpZ2UNCg==
