iptables --tcp-flags

up vote
3
down vote

favorite

Question 1: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP

Question 2: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

asked Mar 4 '17 at 16:02

Croco

184

add a commentÂ |Â

up vote
3
down vote

favorite

Question 1: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP

Question 2: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

asked Mar 4 '17 at 16:02

Croco

184

add a commentÂ |Â

up vote
3
down vote

favorite

Question 1: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP

Question 2: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

asked Mar 4 '17 at 16:02

Croco

184

Question 1: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP

Question 2: are the following rules equal?

iptables -t raw -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t raw -A PREROUTING -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

I'm new to iptables and I'm a bit confused because some tutorials suggest to use those four rules.

iptables

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

asked Mar 4 '17 at 16:02

Croco

184

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

asked Mar 4 '17 at 16:02

Croco

184

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

edited Mar 4 '17 at 16:17

Jeff Schaller

33.6k851113

asked Mar 4 '17 at 16:02

Croco

184

asked Mar 4 '17 at 16:02

Croco

184

asked Mar 4 '17 at 16:02

Croco

184

add a commentÂ |Â

1 Answer
1

active

oldest

votes

up vote
0
down vote

accepted

Yes, they are for both the questions.

ALL is the same as FIN,SYN,RST,PSH,ACK,URG.

Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.

[!] --tcp-flags mask comp
 Match when the TCP flags are as specified. The first argument
 mask is the flags which we should examine, written as a comma-
 separated list, and the second argument comp is a comma-sepaÃ¢Â€Â
 rated list of flags which must be set. Flags are: SYN ACK FIN
 RST URG PSH ALL NONE. Hence the command
 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
 will only match packets with the SYN flag set, and the ACK, FIN
 and RST flags unset.

edited Oct 3 at 13:19

answered Oct 1 at 12:22

prosti

215114

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: false,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f349146%2fiptables-tcp-flags%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
0
down vote

accepted

Yes, they are for both the questions.

ALL is the same as FIN,SYN,RST,PSH,ACK,URG.

Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.

[!] --tcp-flags mask comp
 Match when the TCP flags are as specified. The first argument
 mask is the flags which we should examine, written as a comma-
 separated list, and the second argument comp is a comma-sepaÃ¢Â€Â
 rated list of flags which must be set. Flags are: SYN ACK FIN
 RST URG PSH ALL NONE. Hence the command
 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
 will only match packets with the SYN flag set, and the ACK, FIN
 and RST flags unset.

edited Oct 3 at 13:19

answered Oct 1 at 12:22

prosti

215114

add a commentÂ |Â

up vote
0
down vote

accepted

Yes, they are for both the questions.

ALL is the same as FIN,SYN,RST,PSH,ACK,URG.

Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.

[!] --tcp-flags mask comp
 Match when the TCP flags are as specified. The first argument
 mask is the flags which we should examine, written as a comma-
 separated list, and the second argument comp is a comma-sepaÃ¢Â€Â
 rated list of flags which must be set. Flags are: SYN ACK FIN
 RST URG PSH ALL NONE. Hence the command
 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
 will only match packets with the SYN flag set, and the ACK, FIN
 and RST flags unset.

edited Oct 3 at 13:19

answered Oct 1 at 12:22

prosti

215114

add a commentÂ |Â

up vote
0
down vote

accepted

Yes, they are for both the questions.

ALL is the same as FIN,SYN,RST,PSH,ACK,URG.

Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.

[!] --tcp-flags mask comp
 Match when the TCP flags are as specified. The first argument
 mask is the flags which we should examine, written as a comma-
 separated list, and the second argument comp is a comma-sepaÃ¢Â€Â
 rated list of flags which must be set. Flags are: SYN ACK FIN
 RST URG PSH ALL NONE. Hence the command
 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
 will only match packets with the SYN flag set, and the ACK, FIN
 and RST flags unset.

edited Oct 3 at 13:19

answered Oct 1 at 12:22

prosti

215114

Yes, they are for both the questions.

ALL is the same as FIN,SYN,RST,PSH,ACK,URG.

Check out the man iptables-extensions command on --tcp-flags which is used when the TCP protocol is used: -p tcp.

[!] --tcp-flags mask comp
 Match when the TCP flags are as specified. The first argument
 mask is the flags which we should examine, written as a comma-
 separated list, and the second argument comp is a comma-sepaÃ¢Â€Â
 rated list of flags which must be set. Flags are: SYN ACK FIN
 RST URG PSH ALL NONE. Hence the command
 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN
 will only match packets with the SYN flag set, and the ACK, FIN
 and RST flags unset.

edited Oct 3 at 13:19

answered Oct 1 at 12:22

prosti

215114

edited Oct 3 at 13:19

answered Oct 1 at 12:22

prosti

215114

answered Oct 1 at 12:22

prosti

215114

answered Oct 1 at 12:22

prosti

215114

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Post as a guest

Name

搜尋此網誌

mjhjmtu