When I researched some methods of DDoS protection I faced with some firewall rule which limit packets with RST bit set to 60 per second. Indeed it makes some sense. But it also doesn't check the other flags.
For me it seems that packets with RST flag set and also some other flags set are invalid, so we can drop/reject it.
The questions is: can in practice we see valid TCP RST packets along with other TCP flags (bits) set?
Here is the Linux Iptables rule I'm talking about:
iptables -A INPUT -p tcp --tcp-flags RST RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
I think it should be something like:
iptables -A INPUT -p tcp --tcp-flags ALL RST -m limit --limit 2/s --limit-burst 2 -j ACCEPT
Source: IPtables DDoS Protection for VPS
0 Answers