Re: [xyzzy@sysabend.org: ipnat/ipf state problem]

On Thu, Jul 01, 2004 at 04:32:53PM -0700, Tom Arnold wrote:
> This may all be a cosmetic issue of some kind. As a test today I gave up
> and yanked out the final logging pass statements and installed the rules,
> and even though things werent being logged correctly, it does in fact seem
> to be working just fine. The only reason we had the final logging pass in
> there was to see if something was missing all the quick rules above it.
>
> Based on whats being logged, where does the state table come into play. Is
> it before or after the normal ruleset?

Before. But if you specify "log" all packets from that state will be logged.
You probably want to specify "log first" where only the packet leading
to the state entry will be logged.

-Guido