Differences between NEW and --syn in iptables

lord_zoo · 09-01-2005, 10:10 AM

Can somebody explain this to me, or at least, point me where I can read it?

I tried with the man pages, but, sincerely, didn't understand it completely.

Thanks.

primo · 09-01-2005, 01:00 PM

--syn means a SYN packet (--tcp-flags SYN,ACK,RST SYN)
You know SYNs create new TCP connections...

--state NEW may apply to non-SYN packets...
ie, non-SYN packets may create NEW entries in netfilter's state table

So you must make sure that only SYN's create NEW entries in the state table

Bonus:
Some scanners use SYN/FIN's for portscanning and OS fingerprinting.

These 3 rules alone protect against all invalid combinations:

Code:

iptables -A tcp-in -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A tcp-in -p tcp -m state --state NEW ! --syn -j DROP
iptables -A tcp-in -p tcp -m state --state INVALID -j DROP

Note: We SYN/FIN rule before the check for --syn. There was a bug in the iptables manpage that stated that --syn "only match TCP packets with the SYN bit set and the ACK and FIN bits cleared", which isn't true.

lord_zoo · 09-01-2005, 01:38 PM

Thanks!

The idea was to try to avoid syn floods, but never was sure if the NEW option includes the whole connection process (syn, syn/ack, ack), and the --syn, only the syn bit to start a new connection.

I'm still a little confused with it, but now, at least have a better idea.

Do you know if can be posible to do this? avoid syn floods. Since a can't figure out how to discriminate packets with only the syn flag that doesn't belong to any connection process.

I hope you understand the question (English is not my usual language). ge!

Thanks.

primo · 09-01-2005, 01:46 PM

There's "-m limit" which setups limits on packet matched by the rule. There's syn cookies protection which is usually on by default, and there are various sysctl's that increase the size of many buffers related to TCP

The best tutorials on iptables and ip sysctl's are here:
http://www.frozentux.net/

lord_zoo · 09-02-2005, 02:29 PM

Thanks, I have downloaded the tutorials and i'm ready to read them.

Thanks a lot.