7 ms·
The iptables commands listed in the Mitigation section of the RedHat article lists only SYN in the tcp-flags mask section: iptables -I INPUT -p tcp --tcp-f
by ilikepi 7y ago
The iptables commands listed in the Mitigation section of the RedHat article lists only SYN in the tcp-flags mask section:
iptables -I INPUT -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j DROP
If I interpret the man page correctly, the above is more broad because it does not care about the presence or absence of other flags, whereas your rule explicitly requires the other listed flags to be unset. In fact it seems like the above might be broad enough to include incoming SYNACK response packets that are the result of outgoing connections.
Am I understanding this correctly, and if so, do you have a thought about why they suggest this?
- LinuxBender 7y agoTheirs is just more specific. Both should mitigate the attack, but I would follow theirs instead of my example. They are certainly a better authority on the subject. If something goes wrong, much better to say "Followed vendor suggestions" than random HN poster. :-) That said, I would still use the raw table vs input.