Otdfbt

Os is linux mint 19, i want to setup a rule in iptables to drop the incomming FIN packet as a response of the FIN_WAIT_2 state.
This for a given port. I want to test an application and need some connections staying in the FIN_WAIT_2 tcp state.
Firewall is ufw

If you just want to drop the incoming FIN packet when you always initiate the shutdown of the connection, then a rule such as the following should suffice:

iptables -I INPUT --protocol tcp --destination-port 1337 --tcp-flags FIN FIN -j DROP

However this will mess up closing of connections by the other end of the connection. I don't think that it's possible to only drop the FIN if preceded by an ACK.

Unfortunately I haven't found any notes about checking the tcp flags in the ufw manual.

In iptables your scenario can be implemented in some complex way using the ipset, but there are some limitations. I guess, your host is the tcp client, and server port number is 1234 (free to change it).

# create the ipset list for fin_wait sockets.
# every entry is tuple (local-ip,local-port,remote-ip)
ipset create fin_wait hash:ip,port,ip timeout 3000

# if local host sends the fin packet inside established connection
# add entry into fin_wait list
iptables -A OUTPUT 
 -p tcp --tcp-flags FIN FIN 
 --dport 1234 
 -m conntrack --ctstate ESTABLISHED 
 -j SET --add-set fin_wait src,src,dst --exist

# if local host receives the fin packet for fin wait socket
# drop it before tcp stack processing
iptables -A INPUT 
 -p tcp --tcp-flags FIN FIN 
 --sport 1234 
 -m set --match-set fin_wait dst,dst,src 
 -j DROP

For server there is difference.

# create list for test clients
ipset create test_clients hash:ip

# add addresses of test clients
ipset add test_clients 192.168.100.10

# create list for clients in fin wait state
# server ip,port is known, so ip,port type is enough
ipset create fin_wait_clients hash:ip,port timeout 3000

# if server receives fin from test client
# add client's ip,port into set
iptables -A INPUT -p tcp 
 --dport 1234 
 --tcp-flags FIN FIN 
 -m set --match-set test_clients src 
 -j SET --add-set fin_wait_clients src,src --exist

# if server sends fin to test client as reply
# block this fin
iptables -A OUTPUT -p tcp 
 --sport 1234 
 --tcp-flags FIN FIN 
 -m set --match-set fin_wait_clients dst,dst 
 -j DROP

Some notes:

• Use ipset list fin_wait command to list the current blocked entries from iptables' point of view




• Use ss -t4 state fin-wait-2 command to list sockets in fin wait 2 state




• Order of rules is very important.




• Better use the iptables-save / iptables-restore / iptables-apply tools to safety rule set changing.