Iptables - Drop or Reject the whole connection

Question

I have the following iptables log:

May 13 17:29:20 Test: IN=eth0 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=80 DPT=40660 WINDOW=14480 RES=0x00 ACK SYN URGP=0    
May 13 17:29:20 Test: IN=eth0 LEN=52 TOS=0x00 PREC=0x00 TTL=56 ID=59083 DF PROTO=TCP SPT=80 DPT=40660 WINDOW=114 RES=0x00 ACK URGP=0    
May 13 17:29:23 Test: IN=eth0 LEN=270 TOS=0x00 PREC=0x00 TTL=56 ID=59084 DF PROTO=TCP SPT=80 DPT=40660 WINDOW=114 RES=0x00 ACK PSH URGP=0    
May 13 17:29:23 Test: IN=eth0 LEN=52 TOS=0x00 PREC=0x00 TTL=56 ID=59085 DF PROTO=TCP SPT=80 DPT=40660 WINDOW=114 RES=0x00 ACK FIN URGP=0    

I'm using the following iptables rules to drop the connection when it reaches the third packet (with a length of 270):

iptables -A INPUT -m length --length 270 -j REJECT

I made some tests and see that the connection is not really close if the first packet is passed in my firewall (a tcp SYN packet).

Is there any way to reject the first packet after check the length of third packet?

Thank you!

Answer 1

Using this rule You blocks only packets that match with conditions (input, 270 length), --syn packet made connection established already, so all next packets with length less than 270 will be permit.

So, "to reject the first packet after check the length of third packet" is impossible, connection already exist.

But, "Drop or Reject the whole connection" seems possible :)

1). Log ip addresses:

iptables -A INPUT -m length --length 270 -j LOG --log-prefix "my_firewall:bad_connection" --log-ip-options

This rule must be before rule with REJECT target.

2). Read log by cron and use tcpkill for killing connection:

tcpkill host 111.222.333.444