How to drop bogus tcp packets through iptables?

Question

We are seeing the issue described here - http://archives.neohapsis.com/archives/bugtraq/2002-10/0266.html

In brief, we need to drop bogus packets, such as with SYN+FIN flags set. I can drop this particular packet by adding rule-

iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

Now there could be many more combination of flags. So should I add all of them or is there a better way to do it?

Must be missing something from the report. All this work to prevent os finger printing? Or is there something else I am missing? — Daniel Widrick, Feb 26 '14 at 06:56
Please summarize the issue you're seeing, instead of referring us to a link to read about it. — Andrew Schulman, Feb 27 '14 at 19:18

score 4 · Accepted Answer · edited Apr 13 '17 at 12:14

4

The best time to drop bogus packets is when the packets are not yet tracked, thus in the "raw" table. Or, to be really precise: -t raw -A PREROUTING

Check out the following Community Wiki: iptables tips & tricks by yours truly. One of the 'answers' there already contains a set of rules to drop bogus packets.

edited Apr 13 '17 at 12:14

Community

1

answered Feb 26 '14 at 10:54

pepoluan

4,918
3
43
71

I used the rules mentioned in community wiki link you provided. Thanks! – sudouser Feb 28 '14 at 05:33

score 1 · Answer 2 · answered Feb 26 '14 at 07:39

1

I propose to drop all the INVALID packets if you use the connection tracking with : iptables -A FORWARD -m state --state INVALID -m comment --comment "DROP INVALID" -j DROP

You can see too : -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m comment --comment "Bad TCP Packet" -j DROP -A FORWARD -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m comment --comment "Bad TCP Packet" -j DROP -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m comment --comment "Bad TCP Packet" -j DROP -A FORWARD -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -m comment --comment "Bad TCP Packet" -j DROP -A FORWARD -p tcp -m tcp --tcp-flags FIN,ACK FIN -m comment --comment "Bad TCP Packet" -j DROP -A FORWARD -p tcp -m tcp --tcp-flags ACK,URG URG -m comment --comment "Bad TCP Packet" -j DROP

answered Feb 26 '14 at 07:39

Dom

6,628
1
19
24

You mean `-A INPUT` right? Do I also need to add other combinations like `--tcp-flags ALL FIN,URG,PSH`? – sudouser Feb 26 '14 at 09:23
Dropping INVALID packets ought to be sufficient. Why all the extra rules? – Michael Hampton Feb 26 '14 at 12:07
@sudouser : You are right -A INPUT. My Firewall is using FORWARD. Bad copy/paste, sorry. – Dom Feb 26 '14 at 13:06
1

@Michael Hampton, my solution is to provide some well known combinations which are filtered to in INVALID. You can choose which you want ! – Dom Feb 26 '14 at 13:07
I don't want any of them :) – Michael Hampton Feb 26 '14 at 13:08

How to drop bogus tcp packets through iptables?

2 Answers2