Home / server / Questions / 1020425
In Process
Abc Xyz
Asked: 2020-06-08 12:02:40 +0800 CST

iptables - synproxy target don't mark packets as INVALID

  • 772

I am writing iptables rulles and have problem with preventing flood SYN. Found that synproxy should be the right solution. But when testing, I found that it don't mark packets as INVALID, so iptables rule wont drop it.

$iptables -t raw    -A PREROUTING -p tcp -m tcp -m multiport --dports 25,80,443,587 --syn -j  CT --notrack  
$iptables -t filter -A INPUT      -p tcp -m tcp -m multiport --dports 25,80,443,587 -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
$iptables -t filter -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "IPTABLES=INVALID "                                                                
$iptables -t filter -A INPUT -m conntrack --ctstate INVALID -j DROP
$iptables -A INPUT -j LOG --log-prefix "IPTABLES=PASS "

As I understand it correctly, synproxy target should set invalid state to all packets that does not created 3 way hanshake, but when i use hping3 -c 10000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.0.50 packets are logged as PASS not INVALID.

I also addded to sysctl more strict conntracking, this is necessary to have ACK packets (from 3WHS) marked as INVALID state.

/etc/sysctl.conf
net.netfilter.nf_conntrack_tcp_loose = 0
net.ipv4.tcp_timestamps = 1

I was using this blog post to understand whats happen. But there is nothing more i can change.

Could someone point me what I'm doing wrong?

iptables -nvL
Chain PREROUTING (policy ACCEPT 69965 packets, 9252K bytes)
 pkts bytes target     prot opt in     out     source               destination
38184 6109K CT         tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0 tcp dpt:80 flags:0x17/0x02 NOTRACK

Chain INPUT (policy DROP 98 packets, 4346 bytes)
 pkts bytes target     prot opt in     out     source               destination
34063 5450K SYNPROXY   tcp  --  !lo    *       0.0.0.0/0            0.0.0.0/0            tcp multiport dports 25,80,150,443,587 ctstate INVALID,UNTRACKED SYNPROXY sack-perm t imestamp wscale 7 mss 1460
    0     0 LOG        all  --  !lo    *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID LOG flags 0 level 4 prefix "IPTABLES=INVALID1 "
    0     0 DROP       all  --  !lo    *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
iptables ddos

1 Answers

  1. Looks like SYNPROXY is working alright, it does not mark packets as INVALID but drops them immediately at SYNPROXY target. That's why i couldn't see INVALID packets.

    Weird because previously hping disabled my OS and I had to reboot it, but now is everything alright. Maybe because i had no permanent sysctl settings turned on, who knows.

    • 0