invalid flagged packets dropped

vincix · 01-20-2016, 12:55 PM

I have the following two rules in iptables:

Code:

-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "INVFLAGS: "
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP

This was achieving by using ! --syn -j DROP

I connected through ssh to the server that has these rules, and all of a sudden I saw in /var/log/messages Jan 20 20:42:56 hostname kernel: INVFLAGS: IN=eth0 OUT= MAC=de:51:b9:2f:f5:e5:00:19:56:29:3f:7f:08:00 SRC=MY.HOME.IP.ADDR. DST=X.X.X.X LEN=88 TOS=0x00 PREC=0x00 TTL=56 ID=29505 DF PROTO=TCP SPT=55520 DPT=22 WINDOW=4096 RES=0x00 ACK PSH URGP=0

So my computer was sending what one would consider packets with invalid flags. Why is this happening?

I'm also seeing the ACK PSH flags there, and I'm not sure how I should interpret them.

The thing is, my ssh connection works perfectly, so I'm not sure what is dropping and why this is happening.

Any thoughts? Thanks

lazydog · 01-22-2016, 11:19 AM

You are aware that '!' means Not Equal to?
Without seeing your entire rule set it is hard to say why you are even allowed to connect.

vincix · 01-24-2016, 11:18 AM

Quote:

Originally Posted by lazydog

You are aware that '!' means Not Equal to?
Without seeing your entire rule set it is hard to say why you are even allowed to connect.

To be honest, I don't understand your question in this context. Does the rule not make sense to you with the ! negation? To me, this is just a "classical" rule that makes sure that new tcp connections start with a SYN flag, so making sure that the three-way handshake is done properly.

Anyway, these are the rules that allow for the ssh connection:

Code:

-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -m recent --set --name SSH --mask 255.255.255.255 --rsource
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -m recent --update --seconds 60 --hitcount 4 --name SSH --mask 255.255.255.255 --rsource -j DROP

lazydog · 01-26-2016, 11:25 AM

Do you have a ESTABLISHED and RELATED rule at the top of your chains? Again we are back to the point that without knowing how your rules are setup it is a shot in the dark to tell you why one thing is working or not working as expected.

vincix · 01-26-2016, 01:48 PM

Quote:

Originally Posted by lazydog

Do you have a ESTABLISHED and RELATED rule at the top of your chains? Again we are back to the point that without knowing how your rules are setup it is a shot in the dark to tell you why one thing is working or not working as expected.

Yes I do have that rule. Otherwise, the connection wouldn't have worked altogether. The thing is, I don't see anything wrong the ssh connection, except for those logs.

lazydog · 01-27-2016, 11:56 AM

Is this the only logging rule you have?

vincix · 01-27-2016, 12:37 PM

vincix · 02-09-2016, 12:25 PM

Amazing help, as usual