4

Question 1: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP

Question 2: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.

1 Answer 1

4

Yes, they are for both the questions.

ALL is the same as FIN,SYN,RST,PSH,ACK,URG.

Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.

[!] --tcp-flags mask comp
          Match when the TCP flags are as specified.  The  first  argument
          mask  is  the flags which we should examine, written as a comma-
          separated list, and the second argument comp  is  a  comma-sepa‐
          rated  list  of flags which must be set.  Flags are: SYN ACK FIN
          RST URG PSH ALL NONE.  Hence the command
           iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
          will only match packets with the SYN flag set, and the ACK,  FIN
          and RST flags unset.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .