-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Wed, 22 Jun 2005, Alexey Toptygin wrote:
On Wed, 22 Jun 2005, Taylor, Grant wrote:
# Drop any Null scan packets.
iptables -t filter -A FORWARD -i $INet -o $LAN -p tcp --tcp-flags ALL NONE
-j DROP
# We could put any matches for any other type of scan that we wanted to
here too.
# Allow any stateful traffic back in.
iptables -t filter -A FORWARD -i $INet -o $LAN -m state --state
ESTABLISHED,RELATED -j ACCEPT
TCP packets without flags are possible during a normal TCP connection, you
don't want to drop them. --state ESTABLISHED,RELATED would never let in NULL
scans anyway, because a NULL scan won't establish a valid TCP connection
before it sends flagless packets.
I was under the impression and perhaps again I'm wrong in my
understanding, tht once a connection was established all packets had at
least the ack flags set<?>.
Thanks,
Ron DuFresne
- --
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
admin & senior security consultant: sysinfo.com
http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A E838 B2DF AFCC 94B0 6629
...We waste time looking for the perfect lover
instead of creating the perfect love.
-Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFCuc5est+vzJSwZikRAnQVAJ9nurjYu+VWpnz3QJshOAcFdumGtQCeNwAP
qo0xSiG4TW0WanW41fEonHI=
=B1GT
-----END PGP SIGNATURE-----
