Change from --syn (old Style) to stat NEW

Change from --syn (old Style) to stat NEW

[Markus Feldmann]

Hi All,

i am thinking about changing much of my firewall rules from the old 
style with the <--syn> argument to the new style with the <-m state 
--state NEW> or to the conntrack style.

For example have a look line 221 to 239 in my firewall 
http://pastebin.com/cG0Vc4EW

These are my FTP rules. Therefore i am only using the <! --syn> 
arguments. Is it useful to remove this argument by inserting <-m 
conntrack ! --cstate NEW> to get more safety ?

regards Markus

Re: Change from --syn (old Style) to stat NEW

[Markus Feldmann]

Further on, which improvements for security do you see in my firewall?

regards Markus

Re: Change from --syn (old Style) to stat NEW

[Jan Engelhardt]

On Friday 2010-05-14 14:27, Markus Feldmann wrote:
>
> i am thinking about changing much of my firewall rules from the old style with
> the <--syn> argument to the new style with the <-m state --state NEW> or to the
> conntrack style.
>
> For example have a look line 221 to 239 in my firewall
> http://pastebin.com/cG0Vc4EW
>
> These are my FTP rules. Therefore i am only using the <! --syn> arguments. Is
> it useful to remove this argument by inserting <-m conntrack ! --cstate NEW> to
> get more safety ?

You could combine --syn with --ctstate NEW. That may be
considered a bonus (though I admit I don't do so myself).

Re: Change from --syn (old Style) to stat NEW

[Markus Feldmann]

Jan Engelhardt schrieb:
> 
> You could combine --syn with --ctstate NEW. That may be
> considered a bonus (though I admit I don't do so myself).
Hi Jan,

Nice idea. :-) Could this be a Problem?

As long as i do not redirect the ports, like i did with my Apache-server 
from 80 to 443, it should work to combine --syn with --ctstate NEW ?

However it should be more safety to change from --syn to --ctstate NEW 
for all rules?

regards Markus