Another way of doing? --state NEW -j DROP

Another way of doing? --state NEW -j DROP

[Sylvan]

>> As an aside, one might question why you are using such a limiting tool.  :(

Yeah I admit she's not the smartest of things. The main reason being I'd like to try the router is it uses nearly no electricity. I'm not trying to be 
stingy but in my neck of the woods electricity per unit has just gone up to 72c per unit. In the USA I understand it's around 15c and Australia 32c. 

Another way of doing? --state NEW -j DROP

[Sylvan Andrew - NIDS]

Hello One and All, 

 I am sure this might be an easy answer for someone. Could you please
enlighten me ?

I am using the rule below to drop any inbound connections into my .0.3
Class which by default allows any Outbound connections. Plus if the
connection is already established than those outside connections are ok
as well.

iptables -A INPUT -d 192.168.3.0/24 -m state --state NEW -j DROP

However I am now using a router that doesn't support the -m state
--state NEW rule.(crappy GUI thing) :-( Could someone please tell me another way using
iptables to drop any new inbound connections but allow everything else
outbound and the established connection replys to get back into the .0.3
Class ? What is the most secure/easiest way ?

Many Thanks for your help !

Kind Regards

Sylvan 

Re: Another way of doing? --state NEW -j DROP

[Maximilian Wilhelm]

Anno domini 2008 Sylvan Andrew - NIDS scripsit:

Hi!

>  I am sure this might be an easy answer for someone. Could you please
> enlighten me ?

Let's see. :)

> I am using the rule below to drop any inbound connections into my .0.3
> Class which by default allows any Outbound connections. Plus if the
> connection is already established than those outside connections are ok
> as well.

> iptables -A INPUT -d 192.168.3.0/24 -m state --state NEW -j DROP

> However I am now using a router that doesn't support the -m state
> --state NEW rule.(crappy GUI thing) :-( Could someone please tell me another way using
> iptables to drop any new inbound connections but allow everything else
> outbound and the established connection replys to get back into the .0.3
> Class ? What is the most secure/easiest way ?

So you have to input all your rules via a GUI which does not acceppt
'--state NEW' right?
Asuming yes and the you catched all '--state ESTABLISHED,RELATED'
packet which are/could be answer packets to outbound connections, how
about just leaving '--state NEW' out and DROP'ing all packets
remaining? Obviously after all rules which should accept things.

Nearby:
 DROP'ing unwanted packets IMO is rather bad behavior as it makes
 debugging (possible) network problems a lot harder. If you just
 REJECT packets you don't want (with a appropriate limit) everybody
 knows he is not welcome. So IMO it would be nicer to use
 '-j REJECT --reject-with icmp-admin-prohibited'.

HTH
Ciao
Max
-- 
	Follow the white penguin.

Re: Another way of doing? --state NEW -j DROP

[Grant Taylor]

On 11/2/2008 9:00 PM, Maximilian Wilhelm wrote:
> So you have to input all your rules via a GUI which does not accept 
> '--state NEW' right?

As an aside, one might question why you are using such a limiting tool.  :(

> Asuming yes and the you catch all '--state ESTABLISHED,RELATED' 
> packet which are/could be answer packets to outbound connections, how 
> about just leaving '--state NEW' out and DROP'ing all packets 
> remaining? Obviously after all rules which should accept things.

*nod*

This will work.

As far as TCP, you could watch for the SYN and ACK flag and filter out 
any packet that has are not fully established, i.e. SYN,ACK ACK.

> DROP'ing unwanted packets IMO is rather bad behavior as it makes 
> debugging (possible) network problems a lot harder. If you just 
> REJECT packets you don't want (with a appropriate limit) everybody 
> knows he is not welcome. So IMO it would be nicer to use '-j REJECT 
> --reject-with icmp-admin-prohibited'.

Agreed.

However you need to make sure that you will not reject packets with 
spoofed source address in to your network.  Consider Reverse Path filtering.



Grant. . . .