netfilter seems to allow rejected traffic from my INPUT chain to go through my OUTPUT chain. Here are the rules from the INPUT chain that are applied to the packets in question:

 LOG         all  --  *  *    LOG flags 0 level 6 prefix "ICATCH:"
 REJECT-PKT  all  --  *  *    

The user-defined REJECT-PKT chain and its relevant rule:

 REJECT    tcp  --  *  *    tcp reject-with tcp-reset

Here's the logged result:

May 15 06:41:51 li51-144 kernel: ICATCH:IN=eth0 OUT= MAC=f2:3c:91:1f:61:44:84:78:ac:0d:97:c1:08:00 SRC= DST=<my IP> LEN=40 TOS=0x00 PREC=0x00 TTL=46 ID=46841 PROTO=TCP SPT=8838 DPT=23 WINDOW=22014 RES=0x00 SYN URGP=0
May 15 06:41:51 li51-144 kernel: OCATCH:IN= OUT=eth0 SRC=<my IP> DST= LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=23 DPT=8838 WINDOW=0 RES=0x00 ACK RST URGP=0

The second line is produced by the following (penultimate) rule in the OUTPUT table:

LOG        all  --              LOG flags 0 level 6 prefix "OCATCH:"

I was under the impression that rejected packets were somehow marked by the kernel, and that TCP traffic with an RST flag that resulted from iptables rules was not processed by the firewall.

What have I misunderstood?

  • I think that's normal; if you don't want something sent, then DROP it instead. – Aaron D. Marasco May 21 '17 at 0:15

Like @Aaron said, this is normal.

When incoming packet reaches REJECT rule it will be processed by netfilter and will reply to a sender with RST packet, and message.

However, if you set it to DROP instead, then source will receive no message.

Check this link: Difference between DROP & REJECT

Worth to run tcpdump or wireshark to capture the output and see whats going under the hub.

  • Then is it standard practice to add rules to the filter table's OUTPUT chain that accept these packets immediately, given a default policy of DROP on the chain? – chb May 21 '17 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.