Re: Another way of doing? --state NEW -j DROP

[Grant Taylor <gtaylor@riverviewtech.net>]

On 11/2/2008 9:00 PM, Maximilian Wilhelm wrote:
> So you have to input all your rules via a GUI which does not accept 
> '--state NEW' right?

As an aside, one might question why you are using such a limiting tool.  :(

> Asuming yes and the you catch all '--state ESTABLISHED,RELATED' 
> packet which are/could be answer packets to outbound connections, how 
> about just leaving '--state NEW' out and DROP'ing all packets 
> remaining? Obviously after all rules which should accept things.

*nod*

This will work.

As far as TCP, you could watch for the SYN and ACK flag and filter out 
any packet that has are not fully established, i.e. SYN,ACK ACK.

> DROP'ing unwanted packets IMO is rather bad behavior as it makes 
> debugging (possible) network problems a lot harder. If you just 
> REJECT packets you don't want (with a appropriate limit) everybody 
> knows he is not welcome. So IMO it would be nicer to use '-j REJECT 
> --reject-with icmp-admin-prohibited'.

Agreed.

However you need to make sure that you will not reject packets with 
spoofed source address in to your network.  Consider Reverse Path filtering.



Grant. . . .