iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

So, I just found out that these cute rules don't do s**t when it comes to raw sockets.

I know that grabbing a raw socket requires root permission so I don't care about the OUTPUT chain not getting filtered (I'm sure I don't have any software with backdoor running as SU).

but what about the INPUT chain? isn't not being able to control incoming packets dangerous? if no, then why everyone bother setting the default policy to drop?

  • You said it yourself: "grabbing a raw socket requires root permission". So why does it matter? Nov 12, 2016 at 1:03
  • @MichaelHampton My problem is a little complicated I don't know where to start; I'm running a kvm guest with applications that probably have malicious functionality; I want the guest to be able to have limited communication (some specific ports) with the host through a bridged network but I don't want any data that I can't control to be communicated (either with the host or the internet).
    – A. B
    Nov 12, 2016 at 1:19
  • @MichaelHampton for example dropping all incoming pockets (including raw socket) to that bridge (from guest to host) with the exception of a few tcp ports is what I wanted.
    – A. B
    Nov 12, 2016 at 1:41
  • Hmm. If you can't trust the guest, I would carefully consider using a routed network, or no network at all. Nov 12, 2016 at 2:20
  • @MichaelHampton thanks, I'm gonna google routed network and see what it does, but I'll probably end up with no network at all lol.
    – A. B
    Nov 12, 2016 at 2:39

1 Answer 1


Raw socket does not originate some specific kind of traffic that is "raw", distinct from TCP or UDP or whatever. Raw socket takes L2 = Ethernet frames whole, and it's up to the application to deal with the upper layers. For instance, the ISC DHCP daemon uses a raw socket - thus, it's not subject to local iptables on the same host, but the ISC dhcpd must understand IP and UDP and deal with them on its own.

If you have a suspicious neighbor machine (or a VM) where some software is known to open a raw socket, you do not need to "filter against raw traffic" - you just need to apply "least privilege" = permit select few TCP/UDP ports (and maybe some necessary ICMP) and drop all the rest. Whether the suspect host initiates its traffic via raw sockets or proper TCP/UDP sockets (using its respective OS'es L3/4/5 stack) is irrelevant. Or, if you have some software using a raw socket on the host that you want to keep safe, that software must weed out the traffic it's interested in, and ignore the rest. That way, the raw socket is not principally an inbound security hole.

The DHCP daemon is a good example. It does listen on a raw socket, but in principle it only inspects UDP destined to a well-known port 67. It's only ever willing to respond to packets that mach those criteria. It won't respond to a TCP SYN packet to some random port, and cannot be affected by those kinds of connection attempts, legit or malicious or whatever. So if you only want to expose the dhcpd's UDP port 67 to the suspicious network, you can pretty much apply iptables -A INPUT -i eth123 -j DROP , you do not even need to selectively permit UDP port 67 inbound, because dhcpd's raw socket will circumvent iptables anyway - for its own traffic only.

Also, using a raw socket to speak TCP is a pretty stupid idea. You'd probably have to implement the whole TCP stack in your application = what a waste of effort. Unless you merely want to pull off some attacks along the lines of "new not syn" etc where all you need to know is the right format of the packet to target, say, an overflow hole in a particular TCP stack implementation (the one you're trying to attack).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.