diff options
Diffstat (limited to 'fw/man/fwrules')
| -rw-r--r-- | fw/man/fwrules | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/fw/man/fwrules b/fw/man/fwrules index 143ac08..2a42fe1 100644 --- a/fw/man/fwrules +++ b/fw/man/fwrules @@ -93,6 +93,12 @@ is matched by and by .B port= never - at that moment nobody has called, so there is no far end. +An +.B in +rule naming an +.B ip +therefore cannot decide an announce; it decides the connection that +arrives, which is asked about separately when there is a caller to name. .TP .BI ip= address the address at the far end, optionally carrying a @@ -158,6 +164,12 @@ ICMP has no ports, so its flows are the two addresses alone, which is enough for a reply to an echo to be recognised, but does not tie an ICMP error to the connection it is about. .PP +A fragmented datagram is a train: only its first piece carries ports, so +that piece is matched against the rules and the rest of the train +inherits the answer. +A train whose first piece was never seen - or was refused - is judged on +its addresses alone. +.PP When the rules change, connections the new rules forbid are dropped rather than left to finish: a block blocks. .SH EXAMPLES |