Hello.

I believe it would be useful if routed packets go through connection-tracking (and therefore consume more processing power) only if we want them to and that it would be useful if we could control this. Possibly by destination subnet - for example all our clients with Public IPs.

This way we would offload conntrack and save CPU and have more confidence that IP packets are not "touched" in any way while passing through the Linux-kernel based MikroTik RouterOS

What do you think?


Thanks.

you think like -
or switch the ports, if that is an option on the hardware.

No, he is asking for selective conntrack. I would love to exclude certain traffic from it as well, ie the trillions of udp/53 packets coming into our network from 2+ million source ip addresses. No need to create conntrack entry for them.

Ive seen linux be able to do this I believe ...

Ive seen linux be able to do this I believe ...

http://security.maruhn.com/iptables-tutorial/x4156.html

+1, i need this feature too

+1 for this feature aswell...