diff options
Diffstat (limited to 'fw/doc/design.md')
| -rw-r--r-- | fw/doc/design.md | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fw/doc/design.md b/fw/doc/design.md index c45c86b..c14787c 100644 --- a/fw/doc/design.md +++ b/fw/doc/design.md @@ -179,7 +179,8 @@ filtering is also just correct design — it is why iptables has separate ## What it cannot do It filters connections and packets, not flows over time: no rate limits, -no fragment logic, no ICMP type matching, and IPv6 extension headers are -not walked. Forwarded traffic is invisible to the namespace mode by +no rate limits, no ICMP type matching, and IPv6 extension headers are +not walked — which also means IPv6 fragments do not cross, though IPv4 +ones do, the first piece deciding for the train. Forwarded traffic is invisible to the namespace mode by construction — it never becomes a ctl write, because no local program asked for it. |