LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 04-13-2010, 03:56 PM   #1
reaven
LQ Newbie
 
Registered: Apr 2010
Distribution: Ubuntu 9.04+
Posts: 4

Rep: Reputation: 0
Iptables TTL matchs


HI, I want to block incoming and outgoing traffic that match a TTL range 65-255 is possible to do it in one line since the ttl match only have eq, gt and lt ?

this is what I have.

Code:
Iptables A INPUT -m ttl --ttl-gt 65 j DROP
Iptables A INPUT -m ttl --ttl-lt 255 j DROP
Iptables A OUTPUT -m ttl --ttl-gt 65 j DROP
Iptables A OUTPUT -m ttl --ttl-lt 255 j DROP

Last edited by win32sux; 04-13-2010 at 04:34 PM. Reason: Changed QUOTE tags to CODE tags.
 
Old 04-13-2010, 04:37 PM   #2
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
Welcome to LQ!
Quote:
Originally Posted by reaven View Post
HI, I want to block incoming and outgoing traffic that match a TTL range 65-255 is possible to do it in one line since the ttl match only have eq, gt and lt ?

this is what I have.

Code:
Iptables A INPUT -m ttl --ttl-gt 65 j DROP
Iptables A INPUT -m ttl --ttl-lt 255 j DROP
Iptables A OUTPUT -m ttl --ttl-gt 65 j DROP
Iptables A OUTPUT -m ttl --ttl-lt 255 j DROP
Since 255 is the max you'd already be achieving your objective on the first line. Well, you'd need to change it to a 64 if you want to include 65, but still, my point is that your second line for each chain is not only unnecessary, but also erroneous (due to the fact that it would filter packets with TTL < 65 too). I believe this should suffice:
Code:
iptables -A INPUT -m ttl --ttl-gt 64 -j DROP
iptables -A OUTPUT -m ttl --ttl-gt 64 -j DROP

Last edited by win32sux; 04-13-2010 at 04:52 PM.
 
1 members found this post helpful.
Old 04-13-2010, 04:58 PM   #3
reaven
LQ Newbie
 
Registered: Apr 2010
Distribution: Ubuntu 9.04+
Posts: 4

Original Poster
Rep: Reputation: 0
thanks a lot and glad to be here !
 
  


Reply

Tags
iptables, ttl


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to delete/grab a line which matchs a pattern of a particular column only ? mauludi Linux - Newbie 6 01-18-2010 06:52 PM
iptables TTL change does not work iiv Linux - Networking 3 12-03-2007 09:57 AM
How to change the TTL Value? Chiranjib Pal Linux - Networking 11 08-17-2007 10:17 PM
TTL value gabsik Linux - Networking 7 04-21-2006 05:07 AM
IP TTL help SBK_bg Linux - Networking 2 09-29-2005 10:18 AM


All times are GMT -5. The time now is 07:00 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration