Related established connections, and hosts that utilize TCP syn cookies

[FW WIZ <netfilterwiz () gmail com>]

My question is about tracking related, established connections, and how they
relate to client-server connections when the server utilizes TCP SYN cookies



When a remote server is utilizing TCP syncookies in its stack and a client
makes the initial TCP connection, supplies the working secret function, and
receives the rebuilt SYN,  where does the connection originate from?  Does
this connection originate from the server that replied to the initial
connection request, or from the host that sent the initial TCP SYN?



How is this interpreted by Netfilter when allowing, all outbound traffic by
default and when filtering outbound traffic by default but allowing ingress
and egress related established connections.



Is this treated as a related or an established connection?  Will the packet
be allowed to traverse the filter if the server is attempting to establish
the connection with the originating workstation?



If the connection is seen as having originated from the server, will
Netfilter determine that the connection did not originate from a trusted
interface, address, port, etc, and filter it?



Would it be better to create a rule with iptables to track the connection,
perform criteria checking, and match the outbound packet with the incoming
rebuilt connection from the server when it replies?



The results that I’m finding suggests that the connection is considered to
have originated from the workstation that sent the original TCP SYN, making
most of my other questions not applicable, but I wanted to get insight from
others here.



What are your thoughts?

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards