iptables accept only three-way handshake

Question

With iptables I want to accept three-way handshake of a TCP connection and then drop the connection. Is it possible, if so how?

mulaz · Accepted Answer · 2012-07-11 08:58:45Z

up vote 1 down vote accepted

Check this - search for --tcp-flags

You should accepts packets with SYN, SYN+ACK and ACK flags set, and drop everything else.

answered Jul 11 '12 at 8:58

mulaz
6,6211626

	This won't work since on a "running" tcp-connection many packets contain ACKs. Even on long downloads this is set even it's not necessary. Have just been testing this. – Michuelnik Jul 11 '12 at 13:42
	yes, 'ACK' but not 'SYN' AND 'ACK'. Step two of handshake (syn/ack) has both flags set to 1, not just ACK. – mulaz Jul 11 '12 at 13:46
	That's not, what you said. :-p You say: "SYN, SYN+ACK and ACK" - that last ACK is "just ACK" - isnt it? (AND: The third packet of the handshake is "just a normal" packet containing just an ACK) – Michuelnik Jul 11 '12 at 13:47
	damn not enough coffee i guess.. let me rethink... – mulaz Jul 11 '12 at 14:02
	Ok another idea, after the rules above, you can limit the number of packets ( -m connbytes, --connbytes (number) and --connbytes-mode packets ) to allow only three packets (both directions).... or you could just limit packets to 3 with tcp :) (not sure if it works though, 1 in two out or vice-versa) – mulaz Jul 11 '12 at 14:05

1 Answer