Question

Show how you would use the iptables command to reject all incoming SYN packets that seek to open a new connection with your machine?

Answer 1

# Following is the way to reject all the incoming SYN packets that seek to open a new connection with your machine,

Consider the following iptables command,

iptables -A INPUT -p tcp -m tcp --syn -j REJECT

Let me explain you each part of the above iptables command in detail and show its working,

1) iptables is the gear for network address translation and IPv4 packet filtering where INPUT will add the new rule to the table.

2) Selected chain will get appended by rule to reject all SYN packets with the help of -A.

3) -p stands for protocol to be used . Here its only TCP for SYN packets. Hence -p tcp.

4) -m option signifies usage of tcp extended packet matching module which provides --syn option.

5) --syn is the extension provided by the module mentioned above signifies other tcp flags namely FIN, ACK, RST flags are cleared and only SYN flag is set.

6) If the packet is matched as SYN packet, the reject operation will be done because of -j option which acts as option which decides action to be performed on a successfull match.

7) Finally the REJECT option will reject all the incoming packets matched as SYN packets which will disable all incoming TCP connections while not influencing the outgoing TCP connections.

Hence in above mentioned way it is shown how to use iptables commant to block all the incoming SYN packets seeking to open new connection. :)