How do you block new incoming tcp connections on X port? Needs to be done with iptables. I actually have a working iptables command but we always reach ip_conntrack_max even when ip_conntrack_max isset at very high. There a way to do it without keeping track?
Add a comment
|
4 Answers
If you want to block attempts to establish new sessions to a given port, but still allow packets to established sessions through, you'd need to do something like:
iptables -A INPUT -j DROP -p tcp --syn --destination-port dport
This should allow any connection initiated from the local machine, that happens to use dport as its local port number.
this should block the traffic without involving conn_track:
iptables -A INPUT -j DROP -p tcp --destination-port <your port>
connection tracking should only do its job when you specify -m state or --state in your rules.
-
1The question was for blocking incoming TCP connections - that should have been a huge clue to filter on SYN– PP.Mar 10, 2010 at 14:23
-
as i understand it: when you drop syn packets, there will be no connections, so you can drop every connection to the port. Mar 10, 2010 at 14:50
-
If, for some reason, you have attempted to initiate a connection using that port number as the local port, dropping everything would drop the returning SYNACK, dropping SYN-only packets just stops non-locally-initiated packets. Admittedly, less of a problem when you have a specified destination port, but in the general case...– VatineMar 16, 2010 at 11:29
Dropping --syn will stop new connections and there shouldn't be any half-open connections to track. In general filtering "without keeping track" is possible at the -t raw -I PREROUTING stage.
You could accept everything other than SYN packets. One way to do it would be:
iptables -A INPUT -p tcp '!' --syn --destination-port <your-port> -j ACCEPT
