4

It is often recommended in tutorials and books to filter invalid TCP flags with iptables. I wonder if those aren't already filtered by the kernel itself or the iptables state module. Does anyone have further information on this?

3 Answers 3

2

I guess the TCP specifications do not prohibit some invalid flag configurations. Some systems may choose to send (or had used to send) strange flag combinations, but nowadays only "bad guys" send them(for FIN scan, etc.), so it's advised to filter them out.

By the way, here are the iptables rules that I use to filter them out (probably got these from frozentux iptables tutorial)

#new not syn
-A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

-A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
1
  • 1
    Don't forget to drop all fragments! The iptables fragmentation handling makes it a bit less than ideal. '-A INPUT -f -j DROP'
    – Scott Pack
    Nov 26, 2010 at 1:01
2

Filtering weird TCP flags is typically a good idea for two reasons:

  1. It prevents several types of network scanning
  2. Some (older) system can behave badly when sent weird TCP flags

In iptables you have to do the filtering of such packets by hand (as far as I know), other firewalls such as PF has "scrubbing" modules. Scrubbing is a set of standard rules which tries to remove invalid packets from the stream, ensures all packets have the same TTL etc.

1
  • 2
    At one company I worked for, a previous engineer setup an hourly nmap scan of the entire network. Supposedly as a security measure looking for "bots and stuff". Every hour at 15 past all the IP phones in one department locked up. Good times :)
    – Scott Pack
    Nov 26, 2010 at 1:05
1

New versions of kernels not respond to messages with invalid TCP flags. You could be tested by sending packets with invalid flags Hping3 using the tool. If you need to use iptables , I leave my script:

#!/bin/bash

# -- UTF 8 --

iptables="/sbin/iptables"

CADENA="put INPUT, FORWARD or OUTPUT"

IPWS="put destination IP"

IFACE_Nro1="put input interface (example: wlan0 or eth0)"

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags FIN,RST FIN,RST -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN,PSH SYN,FIN,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN,URG SYN,FIN,URG -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL SYN,FIN,RST,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL ALL -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL NONE -j DROP

You must log in to answer this question.