Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

It is often recommended in tutorials and books to filter invalid TCP flags with iptables. I wonder if those aren't already filtered by the kernel itself or the iptables state module. Does anyone have further information on this?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

I guess the TCP specifications do not prohibit some invalid flag configurations. Some systems may choose to send (or had used to send) strange flag combinations, but nowadays only "bad guys" send them(for FIN scan, etc.), so it's advised to filter them out.

By the way, here are the iptables rules that I use to filter them out (probably got these from frozentux iptables tutorial)

#new not syn
-A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

-A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
share|improve this answer
1  
Don't forget to drop all fragments! The iptables fragmentation handling makes it a bit less than ideal. '-A INPUT -f -j DROP' –  Scott Pack Nov 26 '10 at 1:01

Filtering weird TCP flags is typically a good idea for two reasons:

  1. It prevents several types of network scanning
  2. Some (older) system can behave badly when sent weird TCP flags

In iptables you have to do the filtering of such packets by hand (as far as I know), other firewalls such as PF has "scrubbing" modules. Scrubbing is a set of standard rules which tries to remove invalid packets from the stream, ensures all packets have the same TTL etc.

share|improve this answer
1  
At one company I worked for, a previous engineer setup an hourly nmap scan of the entire network. Supposedly as a security measure looking for "bots and stuff". Every hour at 15 past all the IP phones in one department locked up. Good times :) –  Scott Pack Nov 26 '10 at 1:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.