0

I have an open socket connection, and I want to close it immediately if packet passing through contains certain string. I have tried the following using iptables:

sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo bm --string ".." -j REJECT
sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo bm --string ".." -j DROP

But none of this works, it just freezes connection permanently. How to "cut" the connection permanently?

Note: as a testing application I have used simple netcat. Firstly, I connected client and listener, then sent the string containing forbidden one. After that, no response was received and no more lines could be sent over this connection, even when REJECT rule was used.

2
  • When you reject a packet a response is sent indicating this. When you drop a packet no response is sent. Most likely the application you are using does not know how to handle the former, and might have a very long timeout (often in the order of minutes) for the latter, to allow for really slow and unreliable network connections. Which application are you trying to control?
    – l0b0
    Commented Apr 11, 2018 at 10:00
  • @l0b0 as a testing application I have used simple netcat. Firstly, I connected client and listener, then sent the string containing forbidden one. After that, no response was received and no more lines could be sent over this connection, even when REJECT rule was used.
    – nikrom3000
    Commented Apr 11, 2018 at 10:14

1 Answer 1

1

This I hope does the gig for you. Use REJECT with tcp-reset:

sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo bm --string ".." -j REJECT --reject-with tcp-reset

Try kmp if not worked:

sudo iptables -A INPUT -p tcp --dport 1342 -m string --algo kmp --string ".." -j REJECT --reject-with tcp-reset
3
  • Actually, it does not terminate Netcat listener
    – nikrom3000
    Commented Apr 11, 2018 at 15:50
  • Updated my answer. Try kmp as well.
    – MTG
    Commented Apr 12, 2018 at 11:32
  • it does not work as well. TCP connection does not reset. Tried with Netcat and python's SimpleHTTPServer now.
    – nikrom3000
    Commented Apr 13, 2018 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .