iptables --tcp-flags

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
3
down vote

favorite












Question 1: are the following rules equal?



iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP


Question 2: are the following rules equal?



iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP


I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.










share|improve this question



























    up vote
    3
    down vote

    favorite












    Question 1: are the following rules equal?



    iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
    iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP


    Question 2: are the following rules equal?



    iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
    iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP


    I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.










    share|improve this question

























      up vote
      3
      down vote

      favorite









      up vote
      3
      down vote

      favorite











      Question 1: are the following rules equal?



      iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
      iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP


      Question 2: are the following rules equal?



      iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
      iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP


      I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.










      share|improve this question















      Question 1: are the following rules equal?



      iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
      iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP


      Question 2: are the following rules equal?



      iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
      iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP


      I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.







      iptables






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Mar 4 '17 at 16:17









      Jeff Schaller

      33.6k851113




      33.6k851113










      asked Mar 4 '17 at 16:02









      Croco

      184




      184




















          1 Answer
          1






          active

          oldest

          votes

















          up vote
          0
          down vote



          accepted










          Yes, they are for both the questions.



          ALL is the same as FIN,SYN,RST,PSH,ACK,URG.



          Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.



          [!] --tcp-flags mask comp
          Match when the TCP flags are as specified. The first argument
          mask is the flags which we should examine, written as a comma-
          separated list, and the second argument comp is a comma-sepa‐
          rated list of flags which must be set. Flags are: SYN ACK FIN
          RST URG PSH ALL NONE. Hence the command
          iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
          will only match packets with the SYN flag set, and the ACK, FIN
          and RST flags unset.





          share|improve this answer






















            Your Answer







            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "106"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            convertImagesToLinks: false,
            noModals: false,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













             

            draft saved


            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f349146%2fiptables-tcp-flags%23new-answer', 'question_page');

            );

            Post as a guest






























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes








            up vote
            0
            down vote



            accepted










            Yes, they are for both the questions.



            ALL is the same as FIN,SYN,RST,PSH,ACK,URG.



            Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.



            [!] --tcp-flags mask comp
            Match when the TCP flags are as specified. The first argument
            mask is the flags which we should examine, written as a comma-
            separated list, and the second argument comp is a comma-sepa‐
            rated list of flags which must be set. Flags are: SYN ACK FIN
            RST URG PSH ALL NONE. Hence the command
            iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
            will only match packets with the SYN flag set, and the ACK, FIN
            and RST flags unset.





            share|improve this answer


























              up vote
              0
              down vote



              accepted










              Yes, they are for both the questions.



              ALL is the same as FIN,SYN,RST,PSH,ACK,URG.



              Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.



              [!] --tcp-flags mask comp
              Match when the TCP flags are as specified. The first argument
              mask is the flags which we should examine, written as a comma-
              separated list, and the second argument comp is a comma-sepa‐
              rated list of flags which must be set. Flags are: SYN ACK FIN
              RST URG PSH ALL NONE. Hence the command
              iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
              will only match packets with the SYN flag set, and the ACK, FIN
              and RST flags unset.





              share|improve this answer
























                up vote
                0
                down vote



                accepted







                up vote
                0
                down vote



                accepted






                Yes, they are for both the questions.



                ALL is the same as FIN,SYN,RST,PSH,ACK,URG.



                Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.



                [!] --tcp-flags mask comp
                Match when the TCP flags are as specified. The first argument
                mask is the flags which we should examine, written as a comma-
                separated list, and the second argument comp is a comma-sepa‐
                rated list of flags which must be set. Flags are: SYN ACK FIN
                RST URG PSH ALL NONE. Hence the command
                iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
                will only match packets with the SYN flag set, and the ACK, FIN
                and RST flags unset.





                share|improve this answer














                Yes, they are for both the questions.



                ALL is the same as FIN,SYN,RST,PSH,ACK,URG.



                Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.



                [!] --tcp-flags mask comp
                Match when the TCP flags are as specified. The first argument
                mask is the flags which we should examine, written as a comma-
                separated list, and the second argument comp is a comma-sepa‐
                rated list of flags which must be set. Flags are: SYN ACK FIN
                RST URG PSH ALL NONE. Hence the command
                iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
                will only match packets with the SYN flag set, and the ACK, FIN
                and RST flags unset.






                share|improve this answer














                share|improve this answer



                share|improve this answer








                edited Oct 3 at 13:19

























                answered Oct 1 at 12:22









                prosti

                215114




                215114



























                     

                    draft saved


                    draft discarded















































                     


                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f349146%2fiptables-tcp-flags%23new-answer', 'question_page');

                    );

                    Post as a guest













































































                    Popular posts from this blog

                    How to check contact read email or not when send email to Individual?

                    Displaying single band from multi-band raster using QGIS

                    How many registers does an x86_64 CPU actually have?