Re: conntrack-tools 0.9.14 can not block the connection

[Pablo Neira Ayuso <pablo@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 808 bytes --]

Jozsef Kadlecsik wrote:
> On Fri, 7 May 2010, Pascal Hambourg wrote:
> 
>>> I think what was really meant was tcp_loose, not tcp_be_liberal.
>> In my understanding, tcp_loose only allows conntrack to pick up
>> connections from the middle, but packets are still INVALID until the
>> required number of packets is seen and accepted. Am I wrong ?
> 
> No, the packets are set to the usual states, there's no packet counting.
> 
> With tcp_loose enabled (default) conntrack accepts non-SYN packets as 
> "NEW" ones, i.e. attempts to pick up connections from the middle.
> 
> With tcp_be_liberal enabled (default is disabled) out of window packets 
> are not marked as INVALID.

I have applied the following patch to the documentation based on this
discussion. I have also uploaded a new version of the webpage.

[-- Attachment #2: f.patch --]
[-- Type: text/x-patch, Size: 1867 bytes --]

doc: description on how to block traffic with conntrack was incomplete

From: Pablo Neira Ayuso <pablo@netfilter.org>

This patch completes the documentation with the following discussion
that took place in the mailing list.

http://marc.info/?l=netfilter&m=127335152521674&w=2

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 doc/manual/conntrack-tools.tmpl |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/doc/manual/conntrack-tools.tmpl b/doc/manual/conntrack-tools.tmpl
index b897318..ab4e5fb 100644
--- a/doc/manual/conntrack-tools.tmpl
+++ b/doc/manual/conntrack-tools.tmpl
@@ -19,7 +19,7 @@
   </authorgroup>
 
   <copyright>
-   <year>2008</year>
+   <year>2008-2010</year>
    <holder>Pablo Neira Ayuso</holder>
   </copyright>
 
@@ -198,7 +198,12 @@ conntrack v0.9.7 (conntrack-tools): 1 flow entries have been shown.
 conntrack v0.9.7 (conntrack-tools): 1 flow entries has been updated.
  </programlisting>
 
-<para>Delete one entry, this can be used to block traffic (you have to set <emphasis>/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal</emphasis> to zero).</para>
+<para>Delete one entry, this can be used to block traffic if:</para>
+<itemizedlist>
+ <listitem><para>You have a stateful rule-set that blocks traffic in INVALID state.</para></listitem>
+ <listitem><para>You have to set <emphasis>/proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose</emphasis> or <emphasis>/proc/sys/net/netfilter/nf_conntrack_tcp_loose</emphasis>, depending on your kernel version, to zero.</para></listitem>
+</itemizedlist>
+
 <programlisting>
  # conntrack -D -p tcp --dport 3486
  tcp      6 431982 ESTABLISHED src=192.168.2.100 dst=123.59.27.117 sport=34846 dport=993 packets=169 bytes=14322 src=123.59.27.117 dst=192.168.2.100 sport=993 dport=34846 packets=113 bytes=34787 [ASSURED] mark=1 secmark=0 use=1