Re: How to drop an idle connection with iptables?

[lu zhongda <luzhongda@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2991 bytes --]

Hi Brian:
     First very sorry for confusion, I will explain it in details.
     My question is:
     " Is it possible to configure iptables to monitor activity on 
socket connections, then close or block connections that haven't had any 
activity for a specified amount of time?"

     As to the individual terms, I define them as follows:
     Connection: Socket tcp connection
     Idle:socket connections haven't had any activity for a specified 
amount of time, for example after connection established, data is 
transmitted through connection in big time intervals.
     Drop:  block and discarded the packets between two endpoints of a 
connection or just close the connection

     At least, I hope iptables can confirm whether a connection is idle 
or not by its rules, this is the key point of my problem.
     I have used conntrack of iptables, it seems not work.

     My rules for conntrack to trace and drop idle connection is:
iptables -AINPUT     -p tcp -m state --stateESTABLISHED-j ACCEPT
     iptables -AOUTPUT-p tcp -m state --stateNEW,ESTABLISHED-j ACCEPT
iptables -AINPUT-p tcp ! --syn -m state --stateNEW-j DROP

     I think from conntrack's perspective, a connection is idle once the 
ESTABLISHED typed item in //proc/net/ip_conntrack///is removed after the 
timeout interval of the item.
     The timeout is defined in 
//proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established/ , 
which is defaulted to 5 days, I change it to a short value for testing, 
such as 1 min.
     the linux shell command is: echo "60" > 
//proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established/
     The timeout for ESTABLISHED type item does works, and the item is 
removed after timeout, however the connection is not blocked or dropped 
at all.

     I used a simple echo alike client-server program to test.  The 
client sends a text message to the server, the server echo the message 
back to the client.
    The socket channel between two sides is kept alive. The listening 
port for server is 9999.

     My environment is:
     OS:  Redhat enterprise linux 5.2, kernel version 2.6.18
     Iptables: v1.3.5

     I attached my rules in /etc/sysconfig/iptables for reference, hope 
it can help.
     Thanks for your continuous help.

On 2011-11-23 20:37, Brian J. Murrell wrote:
> On 11-11-23 05:48 AM, lu zhongda wrote:
>>      I felt the scenario you described is not really what I want to know.
> Probably because your request was unclear.
>
>>      I want to know if there is any way to set up iptables so
>>      that it will drop a connection after that connection has been idle
>> for a specified period of time?
> Define "drop", "connection" and "idle".  And why do you feel you need to
> "drop" them?
>
>>     I have tried connection tracking function of iptables, however it
>> seems not work for my case.
> Please explain why it doesn't.  What are you trying to achieve exactly?
>   Perhaps a real-world use-case might help us understand.
>
> b.
>


[-- Attachment #2: iptables --]
[-- Type: text/plain, Size: 1492 bytes --]

# Generated by iptables-save v1.3.5 on Thu Nov 24 15:19:59 2011
*filter
:INPUT DROP [200:29532]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 9999 -j LOG --log-prefix "ACCEPT 9999::" 
-A INPUT -p tcp -m tcp --dport 9999 -j ACCEPT 
-A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m state --state ESTABLISHED -j LOG --log-prefix "conn established::" 
-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "DROP invalid::" 
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A INPUT -i eth0 -p tcp -m tcp --dport 9999 -m state --state NEW -m recent --set --name DEFAULT --rsource 
-A INPUT -i eth0 -p tcp -m tcp --dport 9999 -m state --state NEW -m recent --update --seconds 600 --hitcount 2 --name DEFAULT --rsource -j DROP 
-A FORWARD -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
-A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT 
-A OUTPUT -p tcp -m tcp --sport 9999 -j ACCEPT 
-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j LOG --log-prefix "out conn established::" 
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT 
-A OUTPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP 
COMMIT
# Completed on Thu Nov 24 15:19:59 2011