Re: How to block fragmented UDP packets

Hello,

tomek@xxxxxxxxxx a écrit :
Thanks google i read that using u32 module i can stop fragmented udp
packets. I have router with nat and conntrack and I cannot manage
bandwidth of these packets so I decided to cut them.

Conntrack does reassembly before the packet enters the PREROUTING chains, so fragmentation should not be a problem. Packets may be fragmented again after the FORWARD chains when the packet size is bigger than the output interface MTU and reassembled again before the nat/POSTROUTING chain (NAT needs to work on complete IP datagrams), so you will see fragments only in the mangle/POSTROUTING chain.

I found the rule:
iptables -m u32 --u32 "3&0x20=0x20"
or
|iptables -m u32 --u32 "3&0x20>>5=1"
or
||"4&0x3FFF=1:0x3FFF"
but none works.

These are not valid iptables commands : no command, no chain.
.

Relevant Pages

  • Re: Question. on iptables concept
    ... > one from the outside world to access any resource to the local LAN. ... as routed packets _do not_ go through INPUT nor OUTPUT chains. ... Built-in chains behaviour for filtering implies that whatever packet you ...
    (comp.os.linux.security)
  • Re: Right Interface - Wrong IP
    ... I've setted up a similar configuration, with exactly the same rules, the same iptables' chains, and all works fine. ... My filling is that, when generating packets, the interaction between netfilter and iproute2 looks like this: ... Netfilter OUTPUT hooks are traversed ... POSTROUTING hooks are traversed ...
    (comp.os.linux.networking)
  • Re: Fw: [fw-wiz] Is the order of the rules entered in iptables important?
    ... The INPUT, OUTPUT, and FORWARD chains are all different in IPTables. ... Input is for Packets destined for the local box. ... I was wondering if that is because the boot script has, ...
    (Firewall-Wizards)
  • Re: HTB/CBQ and iptables MARK problem
    ... > I wanted to make a traffic shaping setup and in order to test it i made ... > some simple chains first. ... > I did that in order to test it with http packets which are easy to test. ... > then i download the kernel with 2kbytes/sec. ...
    (comp.os.linux.networking)
  • Re: Packets not traversing the POSTROUTING table?
    ... I have added a very simple rule in my POSTROUTING nat table to log all ... *Beep* The nat table chains see only the first packet of each new ... This means they can see only packets with the state NEW. ...
    (comp.os.linux.networking)