Re: Stateless dropping of packets

[Florian Weimer]

Kevin Buhr <[e-mail]> writes:

>> Is it possible to drop packets, preferably using 2.4 iptables, before
>> the packet triggers updates of some caches (e.g. the route cache)?
>
> If you DROP the packet in a PREROUTING chain, that should work.  Since
> the "filter" table doesn't have a PREROUTING chain, you need to use a
> table that does, like the "mangle" table.  For example:
>
>         iptables -t mangle -A PREROUTING -s 10.0.0.0/8 -j DROP
>
> should drop everything with a source in 10.0.0.0/8 without touching
> the routing cache.

It does, thanks a lot. *phew* Looks as if I don't have to try some
*BSD instead.

Is this extremely important application of the PREROUTING chain
documented somewhere?  Should I feel embarrassed? 8-)