Re: TCP SYN packets which have the FIN flag set.

[Baruch Even <baruch@ev-en.org>]

On Thu, 2004-11-04 at 17:48, Luis Pérez Meliá wrote:
> I'm using iptables.
> 
> In my rules I have this:
>         .
>         .
>         .
>         iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>         iptables -A INPUT -m state --state NEW -p tcp --tcp-flags ALL SYN -j ACCEPT

Please dont do that!

You are not only blocking illegal flag combinations, you are also
blocking perfectly legal ones! And then spreading this bad
configuration.

There are flags in the TCP that we want to be allowed on start of
connections, specifically ECN flags, you can look at
http://www.icir.org/floyd/ecnProblems.html

Note that you will not be able to receive mails from the LKML with such
a setup since LKML server uses ECN.

You can use SYN,ACK,FIN,RST SYN to check for illegal flags.

Baruch