linux-latest (75) unstable; urgency=medium

* From Linux 4.7, the iptables connection tracking system will no longer
automatically load helper modules. If your firewall configuration
depends on connection tracking helpers, you should explicitly load the
required modules. For more information, see
.

— Ben Hutchings Sat, 29 Oct 2016 01:53:18 +0100

Could you please tell me if I am still as safe as before when I enable UFW? It uses iptables for firewall but that’s all I know.

I have no problem to create CT rules attaching helpers to conntrack sessions for TCP and UDP helpers/protocols:

# iptables -t raw -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
CT udp — anywhere anywhere udp dpt:amanda CT helper amanda
CT tcp — anywhere anywhere tcp dpt:ftp CT helper ftp
CT udp — anywhere anywhere udp dpt:1719 CT helper RAS
CT tcp — anywhere anywhere tcp dpt:1720 CT helper Q.931
CT tcp — anywhere anywhere tcp dpt:ircd CT helper irc
CT tcp — anywhere anywhere tcp dpt:1723 CT helper pptp
CT udp — anywhere anywhere udp dpt:sip CT helper sip

And these actually works OK.

But I really miss any documentation how to attach for example GRE helpers. PPTP connection needs GRE. And it seems to me, that only loading nf_nat_proto_gre and nf_conntrack_proto_gre (in addtition to PPTP helper rules as listed above) doesn’t work:

nf_nat_proto_gre 918 1 nf_nat_pptp
…
nf_conntrack_proto_gre 3671 1 nf_conntrack_pptp

attaching GRE helper by CT target doesn’t work either:

window# iptables -t raw -A PREROUTING -p 47 -j CT –helper gre
iptables: No chain/target/match by that name.

window# iptables -t raw -A PREROUTING -p 47 -j CT –helper pptp
iptables: No chain/target/match by that name.

So what is the proper way, to attach “proto” helpers to iptables / conntrack?

Thank you.
L.

In the last exaple let’s say my $NET_ETH1 is 192.168.1.0/24.
Could you explain what $ROUTED_VIA_ETH1 is?

in PREROUTING raw, CT target is used to assign signaling trafic to helper. In forward, nothing change but it is recommended to filter RELATED trafic with caution.

So the –state INVALID rule should be enough.

As far as I can tell, the only one of your combinations that conntrack wouldn’t reject is FIN,PSH,URG, which is legitimate TCP so shouldn’t be dropped. Also your 2nd and 4th rules are redundant, they can be combined into one which ignores PSH.

-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A INPUT -p tcp -m tcp –tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -m state –state INVALID -j DROP

http://www.hideandhack.com | the privacy experts.