LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 08-30-2005, 12:52 PM   #1
Pastorino
Member
 
Registered: Jul 2004
Distribution: RHEL 6.2
Posts: 35

Rep: Reputation: 15
How to use ESTABLISHED,RELATED best?


Hi everyone,

Is it better to put the ESTABLISHED,RELATED rule before the "SYN,ACK and NEW" and "NEW not SYN" rules, like this?

$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A INPUT -p TCP --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset

$IPTABLES -A INPUT -p TCP ! --syn -m state --state NEW -j DROP


or after, like this?


$IPTABLES -A INPUT -p TCP --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset

$IPTABLES -A INPUT -p TCP ! --syn -m state --state NEW -j DROP

$IPTABLES -A INPUT -p ALL -i $INET_IFACE -s 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Thanks
 
Old 08-30-2005, 05:07 PM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Because your 2 filtering rules are only applying to new connections, it's probably best to put the "ESTABLISHED,RELATED" first. The logic being that otherwise every single packet will have to go through those 2 rules even though there's zero chance of ESTABLISHED,RELATED packets being matched. So you're adding latency and notting getting anything for it. By putting it first, the ESTABLISHED,RELATED packets (which there should normally be more of) won't have to pass through unnecessary rules.
 
Old 08-30-2005, 06:21 PM   #3
Pastorino
Member
 
Registered: Jul 2004
Distribution: RHEL 6.2
Posts: 35

Original Poster
Rep: Reputation: 15
Oh Captain, my Captain!

Very good point!

Thanks a lot.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Disconnect An Established Connection metallica1973 Linux - Security 11 08-31-2005 10:15 PM
How to reset established connection? G-Fox Linux - Networking 4 10-02-2003 03:53 PM
what is ESTABLISHED, RELATED or NEW gpagedar Linux - Networking 3 10-01-2003 01:29 AM
iptables: block ports and RELATED, ESTABLISHED Klaus Pforte Linux - Security 6 07-17-2003 11:00 AM
problems with established connection nbc Linux - Newbie 1 08-16-2001 02:11 AM


All times are GMT -5. The time now is 10:45 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration