You're viewing the y.diskcat.com public feed.

Jeff Mossthedarktangent@defcon.social
Oct 7, 2026, 1:16 PM
@hrbrmstr What I meant was that over time the rule would become less and less effective. Soon it would allow my server to connect out to hundreds or thousands of IP addresses on a public CDN network, when it really needs to only talk to a single IP for a few seconds.
💬 1🔄 0⭐ 4

Replies

Rogan DawesRoganDawes@infosec.exchange
Oct 11, 2026, 4:28 AM
@thedarktangent @hrbrmstr the nftset can have an expiry time associated with it, entries not touched get pruned.
For eg a curl “one and done” lookup+connect, set the timeout to say 5s, long enough for the 3-way handshake to end up in conntrack, then you can drop the entry, established connections are usually allowed to continue.
💬 0🔄 1⭐ 2