Subject: [tcpm] Firewall rules and OOB

From: Bob Briscoe <[email-masked]>
Date: Mon, 3 Nov 2014 23:15:57 +0000

Joe,

If the OOB segment arrives at a firewall before the SYN, the firewall 
is nearly certain to drop the OOB segment as a non-SYN packet that is 
not part of a connection opened earlier by a SYN.

Even if OOB arrives second, the following conversation implies some 
firewall admins will have included a rule to drop it:
<http://www.linuxquestions.org/questions/linux-security-4/tcp-packet-flags-syn-fin-ack-etc-and-firewall-rules-317389/>

Search for:
"ACK must exist in existing/related connections."
"At least one flag must be set (cannot have none set)."
"A NULL packet is something you should never see"

I know we have to do traversal experiments, but I found this forum 
while looking for something else.

Bob

________________________________________________________________
Bob Briscoe,                                                  BT

---

From: Joe Touch <[email-masked]>
Date: Mon, 03 Nov 2014 16:22:29 -0800

On 11/3/2014 3:15 PM, Bob Briscoe wrote:
> Joe,
> 
> If the OOB segment arrives at a firewall before the SYN, the firewall is
> nearly certain to drop the OOB segment as a non-SYN packet that is not
> part of a connection opened earlier by a SYN.

Yes, as with any such segment.

> <http://www.linuxquestions.org/questions/linux-security-4/tcp-packet-flags-syn-fin-ack-etc-and-firewall-rules-317389/>

That depends on whether they implement those rules, or that's just "how
they understand it".

And, if those rules are accurate, there are lots of other valid packets
that are not permitted either (e.g., SYN with URG, PSH).

> I know we have to do traversal experiments, but I found this forum while
> looking for something else.

Agreed, but as you note it's just one forum.

This is a great example of why NAT behavior must be modeled correctly,
not just derived from blind rules.

Joe