Re: newnotsyn question

Tom Eastep
Wed, 29 Dec 2004 23:34:39 -0000

On Wed, 2004-12-29 at 15:28 -0800, Jack Coates wrote:

>
> I get a significant number of newnotsyn packet denials from existing,
> valid connections. Most of these seem to be on port 80 and port 25, and
> directionality doesn''t seem to matter (I run public web and mail
> services on the firewall).

If you don''t like the messages then don''t use NEWNOTSYN=No. In
a perfect
network, NEWNOTSYN=No is a reasonable idea; alas, the Internet is far
from perfect. I offer NEWNOTSYN=No because people read books about
firewalling and think that they have to have it; once they see it in
action, they usually change their mind.