Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

See title for the question.

This question relates to a previous question wherein I asked the difference between NEW,ESTABLISHED and RELATED , see it here iptables: difference between NEW, ESTABLISHED and RELATED packets One of the rules has NEW in it, and I'm concerned packets will slip through because I'm accepting ssh traffic once it passes the rule. I think I need to ad ESTABLISHED to the rule as well. And maybe even RELATED if it's possible to spoof both. So that's the question. Is it possible ?

share|improve this question
ssh would defeat any hijack because the man in the middle would not be able to decrypt the payload, peek at the auth details. – Tom H Mar 20 '12 at 19:00
up vote 3 down vote accepted


(at least, not without some vulnerability or bizarre naughtiness involving sequence prediction or boring naughtiness such as man in the middle.)

ssh would protect against those types of attack. even if your attacker managed to convince netfilter to not drop the packets, the ssh server and client would both puke at the random unencrypted traffic and close the connection themselves.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.