| 1 |
Hi all, |
| 2 |
|
| 3 |
This has been bugging me for a while... |
| 4 |
|
| 5 |
I've googled, and can't seem to find a definitive answer to this question... |
| 6 |
|
| 7 |
Lots of references to the Mangle table, but nothing that really explains |
| 8 |
what this table is or does, and when or why I would want/need it. |
| 9 |
|
| 10 |
Currently, I have this in my rules (since forever, honestly don't even |
| 11 |
remember where it came from): |
| 12 |
|
| 13 |
*mangle |
| 14 |
:PREROUTING ACCEPT [1378800222:449528056411] |
| 15 |
:INPUT ACCEPT [1363738727:447358082301] |
| 16 |
:FORWARD ACCEPT [0:0] |
| 17 |
:OUTPUT ACCEPT [1221121261:1103241097263] |
| 18 |
:POSTROUTING ACCEPT [1221116979:1103240864155] |
| 19 |
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG |
| 20 |
FIN,PSH,URG -j DROP |
| 21 |
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP |
| 22 |
-A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP |
| 23 |
-A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP |
| 24 |
COMMIT |
| 25 |
# Completed on Sun Dec 11 14:11:01 2011 |
| 26 |
|
| 27 |
This is on a mail/web server with a static IP, it does not do any NAT |
| 28 |
and does not act as a perimeter firewall, it only protects itself... |
| 29 |
|
| 30 |
Thanks for any pointers to tfm that explains this if there is one, or |
| 31 |
just for a simple explanation if not... |
Archives