Related established connections, and hosts that utilize TCP syn cookies
FW WIZ <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.wizards |
|---|---|
| Message-ID | <[email protected]> |
My question is about tracking related, established connections, and how they relate to client-server connections when the server utilizes TCP SYN cookies When a remote server is utilizing TCP syncookies in its stack and a client makes the initial TCP connection, supplies the working secret function, and receives the rebuilt SYN, where does the connection originate from? Does this connection originate from the server that replied to the initial connection request, or from the host that sent the initial TCP SYN? How is this interpreted by Netfilter when allowing, all outbound traffic by default and when filtering outbound traffic by default but allowing ingress and egress related established connections. Is this treated as a related or an established connection? Will the packet be allowed to traverse the filter if the server is attempting to establish the connection with the originating workstation? If the connection is seen as having originated from the server, will Netfilter determine that the connection did not originate from a trusted interface, address, port, etc, and filter it? Would it be better to create a rule with iptables to track the connection, perform criteria checking, and match the outbound packet with the incoming rebuilt connection from the server when it replies? The results that I’m finding suggests that the connection is considered to have originated from the workstation that sent the original TCP SYN, making most of my other questions not applicable, but I wanted to get insight from others here. What are your thoughts? _______________________________________________ firewall-wizards mailing list [email protected] https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards