How to drop traffic before it hits existing iptables conntrack rule?

Question

I am running an application that injects iptables connection tracking rules into the kernel so the machine can forward incoming UDP traffic to its destination as fast as possible.

Some of the traffic received on this machine is not quite according to spec and the receiving party is not always handling this traffic as it should. Unfortunately the sending hardware supplier says there's nothing wrong with what they're sending and the receiving party supplier says the sender should never send traffic like that, so I'm caught in the middle trying to solve a problem.

The server where I have full control over the traffic uses iptables connection tracking to forward the traffic from one sending party to the receiving party using input from another application. The offending traffic is easily recognizable, it is the only traffic using 0 length UDP payload being sent by the sending party.

How do I make sure my iptables rule dropping the offending traffic is being triggered before conntrack forwards the UDP messages?

Using iptables -A INPUT -p udp --dport 50000:60000 -m length --length 8 -j DROP doesn't work, the packets still flow through the machine. I also tried with a length of 8 (the UDP header size) but the result is the same.

Answer 1

To filter traffic being forwarded, you need the FORWARD chain, the INPUT chain is for traffic destined for system on which the rule is on.

Answer 2

As Timothy Baldwin suggested the filter should be on the FORWARD chain. The length parameter doesn't work on the UDP payload or packet length, but on the IP packet length naturally

So the command that works is iptables -A FORWARD -p udp --dport 50000:60000 -m length --length 28 -j DROP where the length is 20 bytes for the IP heaer and 8 for the UDP header