Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My firewall rules are:

00010      660      73050 allow ip from any to any via lo0
00011        0          0 deny ip from any to
00012        0          0 deny ip from to any
00013        0          0 check-state
00100      131       4192 deny ip from any to any via sis0 keep-state

and so on.

Why is the check-state counter always zero? I thought this rule should match for dynamic rules. And I am sure there are.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.