Mastering Linux Security and Hardening - Second Edition

Blocking invalid packets with iptables

If you've been in the IT business for any length of time, you're most likely familiar with the good old TCP three-way handshake. If you're not, no worries. Here's the simplified explanation.

Let's say that you're sitting at your workstation, and you pull up Firefox to visit a website. To access that website, your workstation and the web server have to set up the connection. Here's what happens:

• Your workstation sends a packet with only the SYN flag set to the web server. This is your workstation's way of saying, "Hello, Mr. Server. I'd like to make a connection with you."
• After receiving your workstation's SYN packet, the web server sends back a packet with the SYN and ACK flags set. With this, the ...