IPFW - Keep State

[Mel]

On Friday 31 August 2007 14:34:51 Grant Peel wrote:

> In a nutsheel, is it really necessary, or is thier a really compelling
> reason to use keep-state for a normal web - email server?
>
> I sometimes see "Too many dynamic rules" and can see a correlation between
> customer complaints and these log entries.
>
> My server all have about 200 rules, most of them counters for bandwidth
> accounting.

It is necessary for NAT, since it doesn't know what to do with replies from 
webservers otherwise (internet:80 => $ext_addr:high_port = what?)

-- 
Mel