holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Change comment on SPT=0 trap

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@375 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2002-12-20 01:13:41 +00:00
parent 1c8b19cfe8
commit 43b6a8acc8
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Shorewall/firewall
View File

@ -3532,9 +3532,9 @@ add_common_rules() {
run_iptables -A tcpflags -p tcp --tcp-flags SYN,RST SYN,RST $disposition run_iptables -A tcpflags -p tcp --tcp-flags SYN,RST SYN,RST $disposition
run_iptables -A tcpflags -p tcp --tcp-flags SYN,FIN SYN,FIN $disposition run_iptables -A tcpflags -p tcp --tcp-flags SYN,FIN SYN,FIN $disposition
# #
# A Shorewall user reported seeing outgoing SYN ACK packets with DPT=0 # There are a lot of probes to ports 80, 3128 and 8080 that use a source
# That prompted me to add the following which will stop an incoming # port of 0. This catches them even if they are directed at an IP that
# SYN with SPT=0 # hosts a web server.
# #
run_iptables -A tcpflags -p tcp --syn --sport 0 $disposition run_iptables -A tcpflags -p tcp --syn --sport 0 $disposition