Iptables TCP Flags

In this sample iptables_tcp_flags_programs.cfg, we validate TCP flags.  Any packet with an invalid combination of TCP flags is routed to the BADFLAGS chain, where it is logged and dropped.

///////////////////////////////////////////////////////////////////////////////
//
// iptables_tcp_flags_programs.cfg
//
///////////////////////////////////////////////////////////////////////////////

        // BADFLAGS -- log and drop bad flags

        =iptables -N BADFLAGS
        =iptables -A BADFLAGS -j LOG --log-prefix "IPT BADFLAGS: " =logopt
        =iptables -A BADFLAGS -j DROP

///////////////////////////////////////////////////////////////////////////////

        // TCP_FLAGS -- check tcp flags

        =iptables -N TCP_FLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ACK,FIN FIN             -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ACK,PSH PSH             -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ACK,URG URG             -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags FIN,RST FIN,RST         -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN         -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST         -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ALL ALL                 -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ALL NONE                -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ALL FIN,PSH,URG         -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ALL SYN,FIN,PSH,URG     -j BADFLAGS
        =iptables -A TCP_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j BADFLAGS

///////////////////////////////////////////////////////////////////////////////

This iptables_tcp_flags_programs.cfg file is #included by the higher-level iptables_programs.cfg file.  In that file, we might have code invoking the TCP_FLAGS chain as follows:

        =iptables -A IN_NETWORK -p tcp -j TCP_FLAGS

For more examples, see Samples.

 
Home | FAQ | News | Intro | Samples | Tutorial | Reference | Software
Developer's Notes | Licensing | Authors | Pikt-Users | Pikt-Workers | Related Projects | Site Index | Privacy Policy | Contact Us
Page best viewed at 1024x768 or greater.   Page last updated 2019-01-12.   This site is PIKT® powered.
Copyright © 1998-2019 Robert Osterlund. All rights reserved.
Home FAQ News Intro Samples Tutorial Reference Software
PIKT Logo
PIKT Page Title
View sample
reset iptables
script config file