iptables

[Corey Edwards]

I have, among others, these three rules:

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 611K  263M ACCEPT all -- *    * 0.0.0.0/0      0.0.0.0/0 state RELATED,ESTABLISHED
15437  910K ACCEPT all -- eth1 * 192.168.0.0/24 0.0.0.0/0
  347 27662 ACCEPT all -- * eth1 0.0.0.0/0      192.168.0.0/24

Rule #2 allow outgoing packets from my LAN. Rule #1 is supposed to use
allow all traffic in response coming back in. The problem is Rule #3,
which I added when I noticed packets getting to the end of the chain.
Some packets aren't matching Rule #1.

Has anyone seen this behavior before? Are those packets ok to drop? I've
set up a LOG target to watch them and so far they've been http and dns
traffic, but that's pretty much all that's on my network anyway. I've
thought about just dropping the packets and seeing what breaks, but this
is a production network and I'd rather not have my phone ringing off the
hook.

Corey