0

I have an open socket connection, and I want to close it immediately if packet passing through contains certain string. I have tried the following using iptables:

sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo bm --string ".." -j REJECT
sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo bm --string ".." -j DROP

But none of this works, it just freezes connection permanently. How to "cut" the connection permanently?

Note: as a testing application I have used simple netcat. Firstly, I connected client and listener, then sent the string containing forbidden one. After that, no response was received and no more lines could be sent over this connection, even when REJECT rule was used.

  • When you reject a packet a response is sent indicating this. When you drop a packet no response is sent. Most likely the application you are using does not know how to handle the former, and might have a very long timeout (often in the order of minutes) for the latter, to allow for really slow and unreliable network connections. Which application are you trying to control? – l0b0 Apr 11 '18 at 10:00
  • @l0b0 as a testing application I have used simple netcat. Firstly, I connected client and listener, then sent the string containing forbidden one. After that, no response was received and no more lines could be sent over this connection, even when REJECT rule was used. – nikrom3000 Apr 11 '18 at 10:14
0

This I hope does the gig for you. Use REJECT with tcp-reset:

sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo bm --string ".." -j REJECT --reject-with tcp-reset

Try kmp if not worked:

sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo kmp --string ".." -j REJECT --reject-with tcp-reset
  • Actually, it does not terminate Netcat listener – nikrom3000 Apr 11 '18 at 15:50
  • Updated my answer. Try kmp as well. – MTG Apr 12 '18 at 11:32
  • it does not work as well. TCP connection does not reset. Tried with Netcat and python's SimpleHTTPServer now. – nikrom3000 Apr 13 '18 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.