Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It is often recommended in tutorials and books to filter invalid TCP flags with iptables. I wonder if those aren't already filtered by the kernel itself or the iptables state module. Does anyone have further information on this?

share|improve this question
up vote 2 down vote accepted

I guess the TCP specifications do not prohibit some invalid flag configurations. Some systems may choose to send (or had used to send) strange flag combinations, but nowadays only "bad guys" send them(for FIN scan, etc.), so it's advised to filter them out.

By the way, here are the iptables rules that I use to filter them out (probably got these from frozentux iptables tutorial)

#new not syn
-A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

-A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
-A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
share|improve this answer
Don't forget to drop all fragments! The iptables fragmentation handling makes it a bit less than ideal. '-A INPUT -f -j DROP' – Scott Pack Nov 26 '10 at 1:01

Filtering weird TCP flags is typically a good idea for two reasons:

  1. It prevents several types of network scanning
  2. Some (older) system can behave badly when sent weird TCP flags

In iptables you have to do the filtering of such packets by hand (as far as I know), other firewalls such as PF has "scrubbing" modules. Scrubbing is a set of standard rules which tries to remove invalid packets from the stream, ensures all packets have the same TTL etc.

share|improve this answer
At one company I worked for, a previous engineer setup an hourly nmap scan of the entire network. Supposedly as a security measure looking for "bots and stuff". Every hour at 15 past all the IP phones in one department locked up. Good times :) – Scott Pack Nov 26 '10 at 1:05

New versions of kernels not respond to messages with invalid TCP flags. You could be tested by sending packets with invalid flags Hping3 using the tool. If you need to use iptables , I leave my script:


# -- UTF 8 --



IPWS="put destination IP"

IFACE_Nro1="put input interface (example: wlan0 or eth0)"

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags FIN,RST FIN,RST -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN,PSH SYN,FIN,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN,URG SYN,FIN,URG -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL SYN,FIN,RST,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,PSH -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL ALL -j DROP

$iptables -A $CADENA -i $IFACE_Nro1 -d $IPWS -p tcp --tcp-flags ALL NONE -j DROP
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.