Re: Blocking UDP Fragments

[Pandu Poluan <pandu@poluan.info>]

On Tue, May 17, 2011 at 03:42, Ryan Gelobter
<r.gelobter@limestonenetworks.com> wrote:
> Can anyone provide me with some help in creating an iptables rule to drop packets such as the ones below? I've modified the amount of XXX in the packet contents since they are normally much larger however they do vary in size. I've come to realize the -f flag does not work for this type of packet and am confused by examples that explain matching by using the u32 module/"more fragments" flag.
>
> U 0.0.0.0 -> 0.0.0.0 +39221@5920:1480
>  XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>  XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>  XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> #
> U 0.0.0.0-> 0.0.0.0 +39221@7400:800
>  XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>  XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>
> U 0.0.0.0-> 0.0.0.0 +39221@2960:1480
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>

If you want to drop all fragmented packets, including the first packet
of the fragment,

iptables -t raw -A PREROUTING -m u32 ! --u32 0x4&0x3fff=0x0 -m comment
--comment \"Fragmented\" -j DROP

Explanation:

-m u32 : use the u32 match
--u32 : the parameter for the u32 match

0x4 : get 32 bits starting byte #4 (very first byte is #0)
&0x3fff : do a bitwise AND against those 32 bits

=0x0 : UN-fragmented packets will have those 14 bits = 0

! : negation, i.e., we want to match packets whose fragmentation bits != 0

Rgds
-- 
Pandu E Poluan
~ IT Optimizer ~
Visit my Blog: http://pepoluan.posterous.com