iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
iptables -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
My understanding of this rule is that all NEW tcp packets should by SYN also. So if they are not NEW and SYN, then we should log them and drop them. I guess Andreasson wants to log them because they may indicate a problem of some sort. So in my log file, I get this:
Jan 30 20:09:27 server kernel: New not syn:IN= OUT=lo SRC=10.0.0.100 DST=10.0.0.100 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=7678 DF PROTO=TCP SPT=34928 DPT=143 WINDOW=32767 RES=0x00 ACK PSH FIN URGP=0
So what's the problem with these packets? It looks like some client is contacting the imapd (which is running on my firewall) with some bad tcp packets?
-- Kevin
