Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #11789

Re: Comment on iptables for a home computer?

Show all headers | View raw

On 22/08/14 09:45, Pascal Hambourg wrote:
> The Natural Philosopher a écrit :
>> On 21/08/14 21:47, Pascal Hambourg wrote:
>>> nomdeplume82008@googlemail.com a écrit :
>>>
>>>> iptables --flush
>>>> iptables --policy INPUT DROP
>>>> iptables --policy OUTPUT DROP
>>>> iptables --policy FORWARD DROP
>>>> iptables --append INPUT -i lo -j ACCEPT
>>>> iptables --append OUTPUT -o lo -j ACCEPT
>>>> iptables --append INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>>>> iptables --append OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>>> In short this ruleset allows only outgoing connections.
>>>
>> Strictly it allows incoming connections that are RELATED to previous
>> outgoing ones as well:
>
> Yes. For instance it includes ICMP error messages and FTP data
> connections, related to outgoing existing connections.
>
>> Typically a DNS request over UDP from port X to
>> remote port 53 will 'allow' a connection from remote port 53 back to the
>> originating port X, though it can't be considered established because
>> UDP never gets 'established'.
>
> A DNS reply packet is ESTABLISHED. Netfilter connection tracking keeps
> some state for UDP flows, and UDP packets can be ESTABLISHED.
>
I don't think the UDP protocol has the concept of ESTABLISHED in it.

A UDP header is source and destination ports and addresses and the 
packet length and a checksum ONLY.

Any concept of a stateful connection has to be implied from thehistory 
of UDP packet flow.

If that statefulness is called 'established' in iptables well all well 
and good, but in my book its 'related'

'established' refers to TCP connections with SYN/ACK responses and a 
valid sequence numbers..in my book..

-- 
Everything you read in newspapers is absolutely true, except for the 
rare story of which you happen to have first-hand knowledge. – Erwin Knoll

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-19 10:20 -0700
  Re: Comment on iptables for a home computer? Andreas Kohlbach <aug14.8.ankman@spamgourmet.com> - 2014-08-19 16:41 -0400
  Re: Comment on iptables for a home computer? Rich <rich@example.invalid> - 2014-08-19 21:16 +0000
  Re: Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-20 08:53 -0700
    Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-21 22:47 +0200
      Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-21 23:37 +0100
        Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-22 10:45 +0200
          Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-22 10:41 +0100
            Re: Comment on iptables for a home computer? Marc Haber <mh+usenetspam1118@zugschl.us> - 2014-08-22 12:00 +0200

csiph-web