Hi Brian:
First very sorry for confusion, I will explain it in details.
My question is:
" Is it possible to configure iptables to monitor activity on
socket connections, then close or block connections that haven't had any
activity for a specified amount of time?"
As to the individual terms, I define them as follows:
Connection: Socket tcp connection
Idle:socket connections haven't had any activity for a specified
amount of time, for example after connection established, data is
transmitted through connection in big time intervals.
Drop: block and discarded the packets between two endpoints of a
connection or just close the connection
At least, I hope iptables can confirm whether a connection is idle
or not by its rules, this is the key point of my problem.
I have used conntrack of iptables, it seems not work.
My rules for conntrack to trace and drop idle connection is:
iptables -AINPUT -p tcp -m state --stateESTABLISHED-j ACCEPT
iptables -AOUTPUT-p tcp -m state --stateNEW,ESTABLISHED-j ACCEPT
iptables -AINPUT-p tcp ! --syn -m state --stateNEW-j DROP
I think from conntrack's perspective, a connection is idle once the
ESTABLISHED typed item in //proc/net/ip_conntrack///is removed after the
timeout interval of the item.
The timeout is defined in
//proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established/ ,
which is defaulted to 5 days, I change it to a short value for testing,
such as 1 min.
the linux shell command is: echo "60" >
//proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_timeout_established/
The timeout for ESTABLISHED type item does works, and the item is
removed after timeout, however the connection is not blocked or dropped
at all.
I used a simple echo alike client-server program to test. The
client sends a text message to the server, the server echo the message
back to the client.
The socket channel between two sides is kept alive. The listening
port for server is 9999.
My environment is:
OS: Redhat enterprise linux 5.2, kernel version 2.6.18
Iptables: v1.3.5
I attached my rules in /etc/sysconfig/iptables for reference, hope
it can help.
Thanks for your continuous help.
On 2011-11-23 20:37, Brian J. Murrell wrote:
On 11-11-23 05:48 AM, lu zhongda wrote:
I felt the scenario you described is not really what I want to know.
Probably because your request was unclear.
I want to know if there is any way to set up iptables so
that it will drop a connection after that connection has been idle
for a specified period of time?
Define "drop", "connection" and "idle". And why do you feel you need to
"drop" them?
I have tried connection tracking function of iptables, however it
seems not work for my case.
Please explain why it doesn't. What are you trying to achieve exactly?
Perhaps a real-world use-case might help us understand.
b.
# Generated by iptables-save v1.3.5 on Thu Nov 24 15:19:59 2011
*filter
:INPUT DROP [200:29532]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9999 -j LOG --log-prefix "ACCEPT 9999::"
-A INPUT -p tcp -m tcp --dport 9999 -j ACCEPT
-A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state ESTABLISHED -j LOG --log-prefix "conn established::"
-A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "DROP invalid::"
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 9999 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -i eth0 -p tcp -m tcp --dport 9999 -m state --state NEW -m recent --update --seconds 600 --hitcount 2 --name DEFAULT --rsource -j DROP
-A FORWARD -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A OUTPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 9999 -j ACCEPT
-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j LOG --log-prefix "out conn established::"
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
COMMIT
# Completed on Thu Nov 24 15:19:59 2011
