Firewalls blocking SYN packets

Hi again, guys.

I'm currently playing with several of the firewall distros and today came across a problem I don't know how to handle correctly.

I first noticed the issue with Endian (which has a set of pre-defined firewall rules), but after adding some basic rules to Vyatta (namely blocking all outbound TCP except for http(s), IMAP(s), POP3(s), SMTP, DNS), hit the same query.

One of the sites I visit is https. I was having difficulty connecting to it. Upon examining the logs, there were some outbound TCP SYN requests that were being blocked, destined for ports 843 and 32256/32257. Allowing these ports out cured the problem.

For future reference, though, rather than open ports (which could vary by the look of it), I was wondering if it was OK to, say, allow all outbound SYN requests from the lan? Or SYN requests for established connections only? Or am I paving the way to vuln city?

Thanks.

After doing a bit of digging I see that SYN packets are the first in creating a TCP handshake - although in this case it must be initiated by the web page loaded in my browser.

(This also assumes that I'm reading pfSense's logs right, and TCP:S doesn't include a SYN ACK?)

If that's the case, I think that allowing all SYN packets from my lan to the host site's network should be reasonably secure.


If anyone knows otherwise please let me know!

It looks as though firewalls aren't as granular as I thought - at least not the ones I'm looking at. I've ended up allowing all TCP packets out to that site. Oh well.

Just in case anyone is interested, it turns out that the Vyatta commercial edition DOES allow filtering by TCP flags. Unfortunately the community edition doesn't.