bridging fw + ip_conntrack didn't work

hello,

i'm using debian with the 2.4.18 kernel and the briding-fw patch.
I have complile a new kernel with the right options (i think it)...

But the conntraking didn't work :-(

Any idea??


CONFIG_IP_NF_CONNTRACK=y
CONFIG_IP_NF_FTP=y
CONFIG_IP_NF_IRC=y
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP_NF_MATCH_LIMIT=y
CONFIG_IP_NF_MATCH_MAC=y
CONFIG_IP_NF_MATCH_MARK=y
CONFIG_IP_NF_MATCH_MULTIPORT=y
CONFIG_IP_NF_MATCH_TOS=y
CONFIG_IP_NF_MATCH_AH_ESP=y
CONFIG_IP_NF_MATCH_LENGTH=y
CONFIG_IP_NF_MATCH_TTL=y
CONFIG_IP_NF_MATCH_TCPMSS=y
CONFIG_IP_NF_MATCH_STATE=y
CONFIG_IP_NF_FILTER=y
CONFIG_IP_NF_TARGET_REJECT=y
CONFIG_IP_NF_NAT=y
CONFIG_IP_NF_NAT_NEEDED=y
CONFIG_IP_NF_TARGET_MASQUERADE=y
CONFIG_IP_NF_TARGET_REDIRECT=y
CONFIG_IP_NF_NAT_IRC=y
CONFIG_IP_NF_NAT_FTP=y
CONFIG_IP_NF_MANGLE=y
CONFIG_IP_NF_TARGET_TOS=y
CONFIG_IP_NF_TARGET_MARK=y
CONFIG_IP_NF_TARGET_LOG=y
CONFIG_IP_NF_TARGET_ULOG=y
CONFIG_IP_NF_TARGET_TCPMSS=y


I i using a statefule rule, i became a warning like this:
iptables: No chain/target/match by that name

Thank you.

Regards,

Marco

And, please don't multi-post. I already gave this answer in cols.
Try to cross-post instead, as I'm wondering how this should be a
security issue anyways.

Marco Mueller wrote:

> hello,
>
> i'm using debian with the 2.4.18 kernel and the briding-fw patch.
> I have complile a new kernel with the right options (i think it)...
>
> But the conntraking didn't work :-(


[snip]

> I i using a statefule rule, i became a warning like this:
> iptables: No chain/target/match by that name


Well,

To start with, what exactly are You trying to do...? - WHAT _exactly_
is the "stateful rule" You are referring to? [First off, check that one
for typos.]

Normally, there is nothing like connection tracking when bridging net-
works together.

Again, You must be more specific about Your problem and Your environ-
ment, respectively.


Cheers, Jack.

--
----------------------------------------------------------------------
My personal reading of the string "MicroSoft" expands to "NanoWeak"...