LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-04-2015, 09:47 AM   #1
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Rep: Reputation: 69
iptables command with ! syn


I enter this command:
iptables -A INPUT -m conntrack --ctstate NEW -m tcp -p tcp ! --syn -j DROP

And in sysconfig/iptables I get this:

-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP

I don't understand exactly how to interpret this line. It seems, at a first glance, absurd to me, because it says to drop all packets that start a tcp connection which do NOT have flags FIN,SYN,RST,ACK SYN. It's quite the reverse of what am writing.

How come all these show up?

Last edited by vincix; 04-05-2015 at 10:45 AM.
 
Old 04-04-2015, 11:40 AM   #2
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 3,615

Rep: Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577
There are two arguments there. The first, "FIN,SYN,RST,ACK" is the mask of flags to be tested, the second, "SYN" is the list of flags that should be set. So, the match triggers if the SYN bit is set and none of the FIN,RST,ACK bits are set, and that match is then negated.
 
1 members found this post helpful.
Old 04-04-2015, 12:13 PM   #3
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Original Poster
Rep: Reputation: 69
Quote:
Originally Posted by rknichols View Post
There are two arguments there. The first, "FIN,SYN,RST,ACK" is the mask of flags to be tested, the second, "SYN" is the list of flags that should be set. So, the match triggers if the SYN bit is set and none of the FIN,RST,ACK bits are set, and that match is then negated.

So basically two opposite conventions are used within the same program (iptables)? This is a little bit odd, but I understand your explanation.
 
Old 04-04-2015, 01:04 PM   #4
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Original Poster
Rep: Reputation: 69
Quote:
Originally Posted by rknichols View Post
There are two arguments there. The first, "FIN,SYN,RST,ACK" is the mask of flags to be tested, the second, "SYN" is the list of flags that should be set. So, the match triggers if the SYN bit is set and none of the FIN,RST,ACK bits are set, and that match is then negated.
Now I realise that I actually don't understand it after all. The idea was to drop ALL tcp packets that are NEW and that do NOT have SYN flag set. If they did, then it made no sense to drop them, would it, if they did have the expected SYN flag set?
 
Old 04-04-2015, 02:24 PM   #5
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 3,615

Rep: Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577
Quote:
Originally Posted by vincix View Post
Now I realise that I actually don't understand it after all. The idea was to drop ALL tcp packets that are NEW and that do NOT have SYN flag set. If they did, then it made no sense to drop them, would it, if they did have the expected SYN flag set?
You can do that with
Code:
--ctstate NEW --tcp-flags SYN NONE
The first arg to --tcp-flags says that the only bit you want to consider is the SYN bit. The second arg says that, of the bits you said to test, match if none are set.

The old "--syn" match does something different that is not particularly suited to a negated match. That "--syn" matcher is a carryover from the old ipchains syntax, and the main reason for its existence in iptables is to make conversion easier.
 
1 members found this post helpful.
Old 04-04-2015, 03:59 PM   #6
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Original Poster
Rep: Reputation: 69
Quote:
Originally Posted by rknichols View Post
You can do that with
Code:
--ctstate NEW --tcp-flags SYN NONE
The first arg to --tcp-flags says that the only bit you want to consider is the SYN bit. The second arg says that, of the bits you said to test, match if none are set.

The old "--syn" match does something different that is not particularly suited to a negated match. That "--syn" matcher is a carryover from the old ipchains syntax, and the main reason for its existence in iptables is to make conversion easier.

I guess you're right, I've been reading from this book which now I realise might be a little bit too old, at least when it comes to this subject, even though it's only from 2009.

So, what would be a correct full command after all to drop new TCPs that don't have SYN flag set?

Code:
iptables -m conntrack --ctate NEW -m tcp -p tcp --tcp-flags SYN NONE -j DROP
Is this correct? Or do I need a "!" somewhere before --tcp-flags or SYN?

Last edited by vincix; 04-04-2015 at 04:00 PM.
 
Old 04-04-2015, 04:59 PM   #7
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 3,615

Rep: Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577
Quote:
Originally Posted by vincix View Post
So, what would be a correct full command after all to drop new TCPs that don't have SYN flag set?

Code:
iptables -m conntrack --ctate NEW -m tcp -p tcp --tcp-flags SYN NONE -j DROP
Is this correct? Or do I need a "!" somewhere before --tcp-flags or SYN?
Looks correct to me. The "--tcp-flags SYN NONE" matches packets that do not have the SYN flag set. You don't need any "!" for that.

Just to explain a bit further, "--syn" matches the flag bits for a valid SYN packet, i.e. a packet with the SYN flag set and none of the (FIN,RST,ACK) flags set. The negation of that would match packets without the SYN flag set, but would also match packets with any of the (FIN,RST,ACK) flags set regardless of the SYN flag. That is not what you stated you were trying to do.

[EDIT]The only difference is the treatment of invalid SYN packets, i.e., packets that have one of (FIN,RST,ACK) set in addition to the SYN flag. "! --syn DROP" would drop those. "--tcp-flags SYN NONE DROP" would not.

Last edited by rknichols; 04-04-2015 at 05:43 PM. Reason: Incorrect "not"s in my negation + following
 
1 members found this post helpful.
Old 04-05-2015, 07:49 AM   #8
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Original Poster
Rep: Reputation: 69
This is quite difficult to take in, even if I know I've understood more difficult things than that. It's just that the convention seems a little bit weird. Anyway, I will have to ponder over it for a while
 
Old 04-05-2015, 10:32 AM   #9
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 3,615

Rep: Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577
Quote:
Originally Posted by vincix View Post
It's just that the convention seems a little bit weird.
Which convention? The one of, "Take a bit field, AND it with a mask, then compare the result to some value?" Seems pretty "conventional" to me.
 
Old 04-05-2015, 10:45 AM   #10
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Original Poster
Rep: Reputation: 69
Ok, I keep messing it up, but now I really think I got it right.

The first list is made up of all the flags that I want to be taken into consideration and the second list is all the flags taken FROM (that's what I hadn't understood) the first list that I want to be matched!

So out of a list of one element (SYN), I want NONE to be matched. Now it really makes sense.

So if I had placed a "!" before SYN NONE, it would have meant that the packet should be dropped if it HAS a SYN in it, right? Which obviously wouldn't have made sense for what I want to do.

Last edited by vincix; 04-05-2015 at 11:19 AM.
 
Old 04-05-2015, 12:02 PM   #11
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Original Poster
Rep: Reputation: 69
Another question: is it correct to write --tcp-flags ACK,FIN,RST ALL? It doesn't need to make sense, but what I'm actually asking is, can you write "ALL" in the second argument so that it tests if all mentioned flags are set?
 
Old 04-05-2015, 01:21 PM   #12
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 3,615

Rep: Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577Reputation: 1577
Quote:
Originally Posted by vincix View Post
Another question: is it correct to write --tcp-flags ACK,FIN,RST ALL? It doesn't need to make sense, but what I'm actually asking is, can you write "ALL" in the second argument so that it tests if all mentioned flags are set?
Yes, that's exactly what it means.
 
1 members found this post helpful.
Old 04-05-2015, 01:32 PM   #13
vincix
Member
 
Registered: Feb 2011
Distribution: Centos 7
Posts: 693

Original Poster
Rep: Reputation: 69
Quote:
Originally Posted by rknichols View Post
Yes, that's exactly what it means.
Thanks a lot for your patience. It really helped!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables blocking SYN-ACK rjordan Linux - Networking 1 06-24-2011 03:39 PM
Adjust iptables to only inbound syn connections guga0001 Linux - Security 1 04-07-2011 08:02 PM
iptables SYN question L1nuxn00b703 Linux - Newbie 2 03-16-2011 06:40 PM
iptables - -syn yawe_frek Linux - Security 2 12-02-2006 04:26 PM
Differences between NEW and --syn in iptables lord_zoo Linux - Security 4 09-02-2005 03:29 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 01:29 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration