Re: newnotsyn question

Tom Eastep
Wed, 29 Dec 2004 23:38:22 -0000

On Wed, 2004-12-29 at 15:34 -0800, Tom Eastep wrote:
> On Wed, 2004-12-29 at 15:28 -0800, Jack Coates wrote:
>
> >
> > I get a significant number of newnotsyn packet denials from existing,
> > valid connections. Most of these seem to be on port 80 and port 25,
and
> > directionality doesn''t seem to matter (I run public web and
mail
> > services on the firewall).
>
> If you don''t like the messages then don''t use
NEWNOTSYN=No. In a perfect
> network, NEWNOTSYN=No is a reasonable idea; alas, the Internet is far
> from perfect. I offer NEWNOTSYN=No because people read books about
> firewalling and think that they have to have it; once they see it in
> action, they usually change their mind.
>

Note that the default value of NEWNOTSYN was changed to "Yes" in
2.0.9.