-f option used with iptables

-f option used with iptables

[rahul shrivastava]

Hi,

my objective is to drop all fragmented packets on my system
following rules are used

iptables -A INPUT -f -j DROP
iptables -A OUTPUT -f -j DROP
iptables -A FORWARD -f -j DROP

above rules are not making any effect
For information, there is no connection tracking support on my
kernel.Since i understand that if connection tracking is enabled on
kernel then filtering based on fragmentation won't work, so i have
remeved connection tracking support.

i have disable offloading parameters for NIC card

i am using ping -s 32768 10.2.2.2 for generating fragments

Am i doing something wrong
or is there anything  that is conflicting with these rules

Thanks in advance

Re: -f option used with iptables

[Michal Kubeček]

On Monday 06 of August 2012 20:00EN, rahul shrivastava wrote:
> 
> my objective is to drop all fragmented packets on my system
> following rules are used

Not a good idea, IMHO.

> iptables -A INPUT -f -j DROP
> iptables -A OUTPUT -f -j DROP
> iptables -A FORWARD -f -j DROP

This doesn't drop every fragmented packet, only second and further 
fragments. Thus the first fragment passes through, waits in a queue 
until it times out (30 seconds on my system) and then causes a 
"fragmentation timeout exceeded" ICMP message.

> i am using ping -s 32768 10.2.2.2 for generating fragments

You should at least tell where are the rules from above set. On the 
system sending the packets, on the system receiving the packets or 
somewhere between them? Also don't forget to mention the kernel version.

                                                      Michal Kubeèek

-f option used with iptables

[rahul shrivastava]

Hi,

my objective is to drop all fragmented packets on my system
following rules are used

iptables -A INPUT -f -j DROP
iptables -A OUTPUT -f -j DROP
iptables -A FORWARD -f -j DROP

above rules are not making any effect
For information, there is no connection tracking support on my
kernel.Since i understand that if connection tracking is enabled on
kernel then filtering based on fragmentation won't work, so i have
remeved connection tracking support.

i have disable offloading parameters disabled for NIC card

i am using ping -s 32768 10.2.2.2 for generating fragments

Am i doing something wrong
or is there anything  that is conflicting with these rules

Thanks in advance

-f option used with iptables

[rahul shrivastava]

Hi,
kernel version is 2.6.35+
I am defining following ACL

iptables -A INPUT -p icmp -i eth1 -m iprange --src-range
172.31.114.1-172.31.114.254 -m iprange --dst-range 192.168.1.1-192.168.1.254 -j
DROP

with above rule i can dop all icmp packets on eth1 interface
but when i add -f option to deny on fragmented packets rule doesnt work

iptables -A INPUT -p icmp -i eth1 -m iprange --src-range
172.31.114.1-172.31.114.254 -m iprange --dst-range 192.168.1.1-192.168.1.254 -f
-j DROP

My abjective is to deny only fragmented packets with specified ip, protocol and
interface and "-f" option doesnt seem to work

Thanks and Regards,
Rahul Shrivastava

Re: -f option used with iptables

[Jan Engelhardt]

On Thursday 2012-06-21 12:46, rahul shrivastava wrote:

>iptables -A INPUT -p icmp -i eth1 -m iprange --src-range
>172.31.114.1-172.31.114.254 -m iprange --dst-range 192.168.1.1-192.168.1.254
>-f -j DROP
>
>My abjective is to deny only fragmented packets with specified ip, protocol
>and interface and "-f" option doesnt seem to work

I can guarantee you that -f matches fragments -- if there are any
by the time the rule is executed.

Re: -f option used with iptables

[rahul shrivastava]

this rule is not working for me
if you know if provide me a rule to drop only fragmented packets

On 6/21/12, Jan Engelhardt <jengelh@inai.de> wrote:
> On Thursday 2012-06-21 12:46, rahul shrivastava wrote:
>
>>iptables -A INPUT -p icmp -i eth1 -m iprange --src-range
>>172.31.114.1-172.31.114.254 -m iprange --dst-range
>> 192.168.1.1-192.168.1.254
>>-f -j DROP
>>
>>My abjective is to deny only fragmented packets with specified ip,
>> protocol
>>and interface and "-f" option doesnt seem to work
>
> I can guarantee you that -f matches fragments -- if there are any
> by the time the rule is executed.
>

Re: -f option used with iptables

[Jan Engelhardt]

On Tuesday 2012-06-26 12:24, rahul shrivastava wrote:

>this rule is not working for me

Then you don't have any fragments.
Remember that there may be defragmenter modules (nf_defrag_ipv4/ipv6)
loaded.

(And cease top-posting.)

>if you know if provide me a rule to drop only fragmented packets


>
>On 6/21/12, Jan Engelhardt <jengelh@inai.de> wrote:
>> On Thursday 2012-06-21 12:46, rahul shrivastava wrote:
>>
>>>iptables -A INPUT -p icmp -i eth1 -m iprange --src-range
>>>172.31.114.1-172.31.114.254 -m iprange --dst-range
>>> 192.168.1.1-192.168.1.254
>>>-f -j DROP
>>>
>>>My abjective is to deny only fragmented packets with specified ip,
>>> protocol
>>>and interface and "-f" option doesnt seem to work
>>
>> I can guarantee you that -f matches fragments -- if there are any
>> by the time the rule is executed.
>>
>