On 07.03.2014 00:39, Anthony Taylor wrote:
On Thu, Mar 6, 2014 at 12:26 PM, Mart Frauenlob
<mart.frauenlob@xxxxxxxxx> wrote:
On 04.03.2014 17:52, Anthony Taylor wrote:
On Sat, Feb 22, 2014 at 4:37 AM, Mart Frauenlob
<mart.frauenlob@xxxxxxxxx> wrote:
On 21.02.2014 23:36, Anthony Taylor wrote:
[...]
So when I'm satisfied with my logs I should just do a:
iptables -P OUTPUT DROP
yep
[...]
nf_conntrack_tcp_be_liberal - BOOLEAN
0 - disabled (default)
not 0 - enabled
Be conservative in what you do, be liberal in what you accept
from others.
If it's non-zero, we mark only out of window RST segments as
INVALID.
see:
Documentation/networking/nf_conntrack-sysctl.txt
cat /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal
0
This appears to be disabled.
Then try to enable it???
echo 1 > /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal
-su: /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal: Permission denied
strange, don't know what is the problem there...
I have found out something that may be helpful. I set up a rule to
accept NEW packets with source port 80. Sure enough that seemed to
clear up my logs.
So now the question is why the heck apache is sending out new packets
on what should be established connections?
this is what I use:
-A BAD_TCP_PACKETS -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m
conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
-A BAD_TCP_PACKETS -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m
conntrack --ctstate NEW -j DROP
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
