HI.
I want to DROP NEW BUT NOT SYN packet.
On My linux box there was next rule
iptables -A FORWARD -p tcp ! --syn -m state --state NEW -j DROP
I’ve try to make the same on MT box -
ip firewall filter add chain=forward action=log tcp-flags=!syn connection-state=new protocol=tcp
ip firewall filter add chain=forward action=drop tcp-flags=!syn connection-state=new protocol=tcp
Then I check log I see next blocked packet
11:49:16 firewall,info forward: in:TECH out:RESERVE, src-mac 00:09:6b:e7:fb:b4, proto TCP (ACK,RST), 192.168.200.58:4895->62.85.54.41:80, len 40
11:49:17 firewall,info forward: in:TECH out:RESERVE, src-mac 00:e0:4c:18:85:77, proto TCP (ACK,FIN), 192.168.200.29:3005->91.151.242.4:44861, len 40
11:49:17 firewall,info forward: in:TECH out:RESERVE, src-mac 00:09:6b:e7:fb:b4, proto TCP (ACK,FIN), 192.168.200.58:4886->62.85.117.59:80, len 40
11:49:19 firewall,info forward: in:TECH out:RESERVE, src-mac 00:09:6b:e7:fb:b4, proto TCP (ACK,FIN), 192.168.200.58:4884->62.85.117.59:80, len 40
11:49:19 firewall,info forward: in:TECH out:RESERVE, src-mac 00:09:6b:e7:fb:b4, proto TCP (ACK,FIN), 192.168.200.58:4886->62.85.117.59:80, len 40
11:49:23 firewall,info forward: in:TECH out:RESERVE, src-mac 00:09:6b:e7:fb:b4, proto TCP (ACK,FIN), 192.168.200.58:4886->62.85.117.59:80, len 40
11:49:23 firewall,info forward: in:TECH out:RESERVE, src-mac 00:e0:4c:18:85:77, proto TCP (ACK,PSH), 192.168.200.29:3137->91.196.75.180:35962, len 50
11:49:28 firewall,info forward: in:TECH out:RESERVE, src-mac 00:e0:4c:18:85:77, proto TCP (ACK,FIN), 192.168.200.29:3148->193.93.50.125:38853, len 40
11:49:29 firewall,info forward: in:TECH out:RESERVE, src-mac 00:13:8f:cd:9d:73, proto TCP (ACK,PSH), 192.168.200.59:2963->84.94.56.211:62525, len 44
11:49:29 firewall,info forward: in:TECH out:RESERVE, src-mac 00:13:8f:cd:9d:73, proto TCP (ACK,FIN), 192.168.200.59:2963->84.94.56.211:62525, len 40
11:49:31 firewall,info forward: in:TECH out:RESERVE, src-mac 00:13:8f:cd:9d:73, proto TCP (ACK,FIN), 192.168.200.59:2991->81.198.46.129:57627, len 40
11:49:31 firewall,info forward: in:TECH out:RESERVE, src-mac 00:09:6b:e7:fb:b4, proto TCP (ACK,FIN), 192.168.200.58:4886->62.85.117.59:80, len 40
11:49:32 firewall,info forward: in:RESERVE out:TECH, src-mac 00:e0:fc:46:d4:54, proto TCP (ACK,PSH), 85.64.15.152:24501->192.168.200.29:3113, len 337
11:49:35 firewall,info forward: in:TECH out:RESERVE, src-mac 00:13:8f:cd:9d:73, proto TCP (ACK,FIN,PSH), 192.168.200.59:2963->84.94.56.211:62525, len 44
11:49:39 firewall,info forward: in:TECH out:RESERVE, src-mac 00:e0:4c:18:85:77, proto TCP (ACK,FIN), 192.168.200.29:3205->193.125.190.58:14168, len 40
Does “connection-state=new” mean (ACK,RST), (ACK,FIN), (ACK,PSH), (ACK,FIN,PSH) also?
How I can describe all connection-state=new “correct packets”?
THX.