Re: IPtables and HTTP/2-Push?

["Walter H." <Walter.H@mathemainzel.info>]

[-- Attachment #1: Type: text/plain, Size: 1344 bytes --]

On 14.09.2017 10:42, Walter H. wrote:
> Hello,
>
> when I have these two rules on client side (Browser)
>
> # Allow anything out on WAN
> -A OUTPUT -o iface-wan -j ACCEPT
> # Allow established, related packets back in
> -A INPUT -i iface-wan -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> or on firewalls/routers
>
> # Allow anything out on WAN
> -A FORWARD -i iface-lan -o iface-wan -j ACCEPT
> # Allow established, related packets back in
> -A FORWARD -i iface-wan -o iface-lan -m state --state ESTABLISHED,RELATED
> -j ACCEPT
>
>
> what happens to to packets that the Server pushes without request?
>
> I ask this because I see in the logs regularly a few entries like this
>
> [13-Sep-2017; 16:42:06.415850] IPv6[FWD]: IN=sit1 OUT=br0
> SRC=2a00:1450:4001:0811:0000:0000:0000:200e
> DST=LANprefix:0000:0000:0000:1234 LEN=123 TC=0 HOPLIMIT=60 FLOWLBL=262223
>
> as I filtered away INVALID, I can imagine, that these blocked packets come
> from HTTP/2-Push ...
>
> Am i right?
>
> Greetings,
> Walter
>
p.s. this is not limited to IPv6,
also IPv4
e.g.
[17-Sep-2017; 08:42:21.259878] IP[IN]: IN=eth1 OUT= 
MAC=24:xx:xx:xx:xx:24:24:xx:xx:xx:xx:24:08:00 SRC=151.101.112.188 
DST=#WAN-IP# LEN=115 TOS=0x00 PREC=0x00 TTL=59 ID=63615 DF PROTO=TCP 
SPT=443 DPT=53156 WINDOW=57 RES=0x00 ACK PSH URGP=0


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 3491 bytes --]