Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With iptables I want to accept three-way handshake of a TCP connection and then drop the connection. Is it possible, if so how?

share|improve this question
Out of curiosity, why would you want that? – Tibor Jul 11 '12 at 13:24
up vote 0 down vote accepted

Check this - search for --tcp-flags

You should accepts packets with SYN, SYN+ACK and ACK flags set, and drop everything else.

share|improve this answer
This won't work since on a "running" tcp-connection many packets contain ACKs. Even on long downloads this is set even it's not necessary. Have just been testing this. – Michuelnik Jul 11 '12 at 13:42
yes, 'ACK' but not 'SYN' AND 'ACK'. Step two of handshake (syn/ack) has both flags set to 1, not just ACK. – mulaz Jul 11 '12 at 13:46
That's not, what you said. :-p You say: "SYN, SYN+ACK and ACK" - that last ACK is "just ACK" - isnt it? (AND: The third packet of the handshake is "just a normal" packet containing just an ACK) – Michuelnik Jul 11 '12 at 13:47
damn not enough coffee i guess.. let me rethink... – mulaz Jul 11 '12 at 14:02
What about simply using the conntracking? -m state --state ESTABLISHED -j DROP? – Michuelnik Jul 11 '12 at 14:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.