• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 187
  • Last Modified:

How do you say "Deny all packets without the response bit set"?

I beleive there is a way to add a rule to iptables that drops all incoming packets without the response bit set. I want to only drop the packets from eth1.

0
rfr1tz
Asked:
rfr1tz
  • 4
  • 2
  • 2
  • +1
1 Solution
 
ahoffmannCommented:
iptables .... -m state --state NEW -j DROP
# or
iptables .... ! --syn -j DROP
0
 
rfr1tzAuthor Commented:
I've got three NIC's. Only one is connected to the internet (eth1). This command looks like it may stop packets coming in from inside the firewall.

Maybe I shouldn't route and firewall on the same box?
0
 
ahoffmannCommented:
iptables ... -i eth1 ....

> .. looks like it may stop packets coming in from inside ..
if you didn't specify the interface for iptables, the rule applies to all interface
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
jerich1Commented:
Blocking Pings:

iptables -A INPUT -p icmp --icmp-type echo-reply -i eth1
-j DROP

iptables -A INPUT -p icmp --icmp-type echo-request -i eth1 -j DROP




Let me know if this works.
0
 
jerich1Commented:
Blocking Pings:

iptables -A INPUT -p icmp --icmp-type echo-reply -i eth1
-j DROP

iptables -A INPUT -p icmp --icmp-type echo-request -i eth1 -j DROP




Let me know if this works.
0
 
mbarbosCommented:
If my guess about what you want to do is right, have also a look at -m state --state ESATBLISHED,RELATED
0
 
ahoffmannCommented:
jerich1, what's the relation of your suggestion to the question?
mbarbos, my suggestion was to DROP all packets with state NEW, so the packets with state ESATBLISHED,RELATED are passed
0
 
mbarbosCommented:
ahoffmann, did I say "ahoffmann is wrong" ? I just pointed out that the state machine also knows about ESTABLISHED and RELATED (and INVALID:).
0
 
ahoffmannCommented:
mbarbos, no you didn't say "wrong",
I just tried to point out that ESATBLISHED,RELATED are passed when dropping NEW.
It's some of the mystery dragons in iptables, somwhow ...
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 4
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now