Re: IPFilter and Xen

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

On Thu, Mar 11, 2010 at 07:40:43AM +0100, Emmanuel Dreyfus wrote:
> Manuel Bouyer <bouyer%antioche.eu.org@localhost> wrote:
> 
> > But I don't use much "keep state" (actually I avoids it as much as 
> > possible).
> 
> As far as I understand, they ensure that ICMP traffic related to
> authorized TCP/UDP data can get back through. Do you just allow all
> ICMP?

At last icmp-type unreach; and for most case all icmp.

-- 
Manuel Bouyer <bouyer%antioche.eu.org@localhost>
     NetBSD: 26 ans d'experience feront toujours la difference
--