Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've encountered some iptables configuration with incoming rules starting with a rule that allows all TCP packets with ACK flag, followed by all the obvius service port rules. Why is that? The server still responds with this rule disabled. Is there a useful acceptance of ACK for other ports then the served services ones?

share|improve this question
Do you have an example of such a rule? – Michael Hampton Feb 27 '14 at 13:47
Yes, for example: -P INPUT DROP -A INPUT -p tcp -m tcp --tcp-flags ACK ACK followed by the usual service-port matching rules. – dronus Feb 27 '14 at 19:59
up vote 0 down vote accepted

The person that engineered the firewall is probably the best person to answer the why is this here? question.

If I take a stab at finding a useful use case:

Premise: TCP packets with the ACK flag are common

Premise: Will stop evaluating at the matching first ACCEPT, DROP, REJECT, etc.. rule

Assumption: ACK packets are largely harmless

#Accept any TCP Acknowlegements and let the OS / Service handle any issues
-A INPUT -m tcp -p tcp --tcp-flags ACK -j ACCEPT

-A INPUT -m tcp -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m tcp -p tcp -m state --state NEW --dport 80 -j ACCEPT

Conclusion: The ACK statements may have been added to increase Firewall performance.

I don't have any benchmarking to back up such an assumption.

share|improve this answer
Well, the engeneer is possible 'seen that somewhere in the internet' in this case I guess. However, your explanation give me the feeling that there is no magic effects in this and this is simply for performance as you said, or maybe a relic. – dronus Feb 27 '14 at 19:45
@dronus That "ACK packets are largely harmless" isn't really a valid assumption. This creates a hole in the firewall big enough to portscan through; nmap even has a flag to do an ACK scan which this rule will permit. – Michael Hampton Feb 27 '14 at 20:55
So the config done that way out of what reason whatever, is flawed and should not be used? – dronus Feb 27 '14 at 21:01
It is not inherently 'flawed'. It depends on the use case. If performance is a higher priority than security, it may have merits. If security is important, it has flaws. The world will never be black and white. – Daniel Widrick Feb 27 '14 at 23:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.