From: Tom van Leeuwen <tom.van.leeuwen@saasplaza.com>
To: Shawn Wilson <ag4ve.us@gmail.com>,
jack seth <bird_112@hotmail.com>,
"netfilter@vger.kernel.org" <netfilter@vger.kernel.org>
Subject: Re: Getting iptables not to reply
Date: Mon, 30 Sep 2013 20:48:51 +0200 [thread overview]
Message-ID: <5249C793.7010201@saasplaza.com> (raw)
In-Reply-To: <d258c476-1215-47ba-84cc-9ca16fba3ca7@email.android.com>
Hi,
It seems Jack does not want any response...
So what happens when you hit a machine that has a port closed? Well:
this happens (telnet 127.0.0.30 443):
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
20:42:07.706751 IP 127.0.0.1.34056 > 127.0.0.30.443: Flags [S], seq
2590507944, win 43690, options [mss 65495,sackOK,TS val 3717641 ecr
0,nop,wscale 7], length 0
20:42:07.706778 IP 127.0.0.30.443 > 127.0.0.1.34056: Flags [R.], seq 0,
ack 2590507945, win 0, length 0
In response to my TCP SYN packet on loopback ip 127.0.0.30:443, which
does not have a service running, you see the kernel respond with a TCP RST.
Jack: You're talking about a router. Is the router being hit here on a
closed port, or is some machine behind the router being hit on a closed
port?
Only option I see, which really sucks and __I DO_NOT_RECOMMEND_THIS__
because it may also DROP legitimate RST packets when the service
actually wants to send it:
iptables -I OUTPUT -p tcp -s 127.0.0.30 --sport 443 --tcp-flags RST RST
-j DROP
I'm interested in a more clean solution though!
Regards,
Tom van Leeuwen
On 09/30/2013 07:35 PM, Shawn Wilson wrote:
> Err should've been FIN, SYN, or RST
>
> Shawn Wilson <ag4ve.us@gmail.com> wrote:
>> Do you want to respond with ACK, FIN, or RST?
>>
>> jack seth <bird_112@hotmail.com> wrote:
>>> Ok, if you have an 'accept' rule for a service that is not currently
>>> running, is it possible to have iptables to simply not respond instead
>>> of reporting the port as 'closed'? During a port scan at grc.com, if
>>> the router doesn't reply the port will be reported as 'stealth'.
>>> --
>>> To unsubscribe from this list: send the line "unsubscribe netfilter"
>> in
>>> the body of a message to majordomo@vger.kernel.org
>>> More majordomo info at http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2013-09-30 18:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-30 15:58 Getting iptables not to reply jack seth
2013-09-30 17:32 ` Shawn Wilson
2013-09-30 17:35 ` Shawn Wilson
2013-09-30 18:48 ` Tom van Leeuwen [this message]
2013-09-30 18:58 ` Tom van Leeuwen
2013-09-30 23:56 ` Shawn Wilson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5249C793.7010201@saasplaza.com \
--to=tom.van.leeuwen@saasplaza.com \
--cc=ag4ve.us@gmail.com \
--cc=bird_112@hotmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.