Re: iptables and INVALID packet filtering.

David Dejaeghere <[email protected]> Thu, 4 Apr 2013 16:22:17 +0200

Newsgroups	gmane.linux.debian.devel.firewall
Message-ID	<CAO9DwO8BCTtU8Sw=yMLVa2BVT=r3d6KmuEBskM_46=r3meSduQ@mail.gmail.com>

*>> iptables -A INPUT -m conntrack --ctstate INVALID -j DROP *

Should be fine if you want to drop any INVALID packers both tcp, udp

Kind Regards,

David


2013/4/4 Daniel Curtis <[email protected]>

> Hi
>
> I would only ask about iptables (1.4.14-3.1) rule, which is responsible
> for filtering INVALID packets. If I decide to use this rule;
>
> >> iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
>
> That's an example. By using this rule, iptables will also check tcp and
> udp protocols or should I use something like;
>
> >> iptables -A INPUT -p tcp (...)
> >> iptables -A INPUT -p udp (...)
>
> Which solution/rule is correct and it is better to implement?
>
> Best regards.
>