iptables drop length and TTL condition doesn't work [closed]

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.

Closed 9 years ago.

Improve this question

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if both conditions are TRUE.

sudo iptables -N LOGDROP
sudo iptables -A OUTPUT -m ttl --ttl-gt 22 -j LOGDROP
sudo iptables -A INPUT -m ttl --ttl-gt 22 -j LOGDROP
sudo iptables -A LOGDROP -m length --length 722:65535 -j DROP

IP-adress of host is 10.6.7.9 with firewall.

I did 4 test from this host, trying to ping another host:

ping -s 10000 -t 250 10.6.7.10 //fail (TTL AND LENGHT are wrong)
ping -s 100 -t 200 10.6.7.10 //success (TTL is wrong)
ping -s 10 -t 10 10.6.7.10 //success (Both are right)
ping -s 10000 -t 10 10.6.7.10 // fail, BUT SHOULD BE TRUE.

Why last ping doesn't work ,and how to fix it? Thanks for any help.

Answer 1

The problem is the reply path.

With ping -t you will only change the TTL for the packets that you are sending. The reply packets will have a starting TTL set to the OS default (64 in Linux).

So in the forth case your outgoing packets will have a TTL of 10 and a size of ~10000. The packets that are coming back form 10.6.7.10 will have a TTL of 64 and a size of ~10000 and thus will be dropped.

You can use a sniffer, for example wireshark, to verify this.