1

I've got two Ubuntu boxes, A and B.

A is starting a TCP connection to B.

I want A's TCP SYN packet to arrive at B, but when B's SYN/ACK reply packet comes back to A, I want A's firewall to drop it.

What's the easiest way to accomplish this?

Improve this question
2
  • Just curious, why would you want this? Academic purposes?
    – mtak
    Aug 16, 2016 at 20:10
  • 3
    Yeah, it's not a firewall rule I'd want to use on a real system. I'm trying to reproduce a network problem that we encountered with a faulty router.
    – Runcible
    Aug 16, 2016 at 20:22

1 Answer 1

Reset to default
3

The following iptables rule will drop ACK's from host A:

iptables -A INPUT -s ip.of.host.a/32 --protocol tcp --tcp-flags ACK ACK -j DROP

--tcp-flags is documented in the man page for iptables-extensions:

[!] --tcp-flags mask comp Match when the TCP flags are as specified. The first argument mask is the flags which we should examine, written as a comma-separated list, and the second argument comp is a comma-separated list of flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the command

 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN

will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset.
Improve this answer
2
  • Ah, my thanks. I think it needs to be --tcp-flags ACK ACK. Otherwise, I get a "iptables v1.4.21--tcp-flags requires two args" error. Strangely the man pages for iptables doesn't mention --tcp-flags at all.
    – Runcible
    Aug 16, 2016 at 20:40
  • 1
    Thanks, I updated the answer. Also found where --tcp-flags is documented for your reference :)
    – mtak
    Aug 16, 2016 at 20:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .