I've got a Kali Linux box I use for pen testing.

I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them.

e.g. if I run a netcat listener on port 80, I would like connections from the internet to be possible, but as soon as I stop netcat I would like the packets to be dropped rather than rejected.

I know this would be possible by the use of scripts, but is there any support for iptables to do this automatically?

I have had a suggestion to use the NFQUEUE target for all incoming packets, but then I'll have to modify the source of the listening application (if no user-space application is listening on the specified queue, the packets are dropped).

  • What are you trying to achieve with this? Prevent outgoing RST or something else?
    – domen
    Commented Jan 8, 2020 at 9:19
  • @domen At the time it was to keep an external facing host in "stealth" when not being used for pentesting. Commented Jan 8, 2020 at 10:50

5 Answers 5


If never seen this done without a script, so here is a baseline script for you to accomplish this:

checkht="lsof -c httpd | awk '{print $1}' | uniq | grep h"

if [ -n "$checkht" ]; then

    echo "webserver is running let me shut down uptables rules blocking HTTP"
    iptables -vnL --line-numbers |awk '/tcp dpt:80/{print "iptables -D INPUT "$1}' | sh


   iptables -A INPUT -s -p tcp --dport 80 -j DROP


Checks to see if http is running, if it is, it makes sure that IPTABLES has no rule blocking HTTP. If it's not running, it blocks the world from reaching that port. However, because you're not listening on the port, the rule to block makes little sense. There is nothing for anyone to attack since nothing is running.

  • Thanks. It is possible to detect whether there is anything listening because of the RST reply - that's why it makes sense to drop it. Commented May 19, 2014 at 14:17
  • Understood, I usually have a drop all rule as my last rule, so no resets are sent.
    – munkeyoto
    Commented May 19, 2014 at 14:37
  • Do you have to remove that rule if you start services listening? Commented May 19, 2014 at 14:39
  • You can run it via cron to check like N amount of minutes, or... You can likely make your own apachectl like start file to run it in the background. Depends on your machine. You can run it from cron to check like every minute or so, or like I said, edit apachectl, so when you shut off HTTP, it does its checks and balances
    – munkeyoto
    Commented May 19, 2014 at 15:01

What you want to do is simply drop outgoing RST's and ICMP unreachable messages. That way your machine will simply end up ignoring unknown traffic, while SYN packets to open ports will be answered. See solutions at https://stackoverflow.com/questions/13215135/how-to-make-all-outgoing-rst-drop


The short answer is: no by design, and here's an example of what would need to happen if it was possible:

  1. netcat opens socket on port X by calling the relative syscall (such as listen)
  2. kernel traps syscall, executes network code (in this case, opens port)
  3. kernel talks to the relative iptables module (assuming it's available and loaded) and opens a hole in the firewall to let traffic go to the newly opened port.

This would open up a potential security hole: how would the kernel know that the program is legitimate, i.e. is not a trojan that wants to open a remote shell? Here are a few answers:

  • Because the program is whitelisted somewhere; but this would shift the security into another set of issues:
    • how do you know that the program hasn't been compromised? You could use something like tripwire, but this opens up another security question: how can you guarantee that the master list is not compromised?
    • how do you deal with updates? E.g. version Z of ssh can punch holes through the firewall; your system self-updates, now the hash of ssh changed, and you are locked out.
  • Because the user launching it belongs to a privileged group: how do you deal with SUID binaries? Take a look at the ping program permissions for example.

Another can of worms^W^W^W set of potential issues would be the interface between iptables (at kernel level) and the syscalls; every minor change in iptables would require a potential rewrite of the code underlying the syscalls, introducing bugs, etc.

In a nutshell, you are describing the problem that application firewalls face (think about Windows or Mac firewalls). It's do-able, but it's not simple.

At a networking level you might want to take a look at UPnP whose function was to allow services to punch holes through a gateway's firewall. With the obvious security consequences.

Or you could use a script instead :)


you could write a simple bash script that parses out netcat output and builds a new iptables ruleset accordingly every time its running.

You probably have to make sure that you allow connections first before you set the drop all rule else you would reset all running connections each time the script runs.

Then you could set a cronjob that will run your script every minute.

As lorenzog pointed out this might not be the most secure setup, on the other hand if you have no iptables running by default then this is probably better than nothing.

Also you could set a range of port as a whitelist and ignore all other ports that netstat spits out...

As this is about your Kali box (VM?) it should only be running for specific tasks anyways. Kali is not meant to be used as a default client/server operating system for daily tasks. So I would let you get a away with this kind of dynamic firewall setup ;)


No need for scripts; there is a suitable iptables-extensions module:

This matches if an open TCP/UDP socket can be found by doing a socket lookup on the packet. It matches if there is an established or non-zero bound listening socket (possibly with a non-local address). The lookup is performed using the packet tuple of TCP/UDP packets, or the original TCP/UDP header embedded in an ICMP/ICPMv6 error packet.

    Ignore non-transparent sockets. 
    Do not ignore sockets bound to 'any' address. The socket match won't accept zero-bound listeners by default, since then local services could intercept traffic that would otherwise be forwarded. This option therefore has security implications when used to match traffic being forwarded to redirect such packets to local machine with policy routing. When using the socket match to implement fully transparent proxies bound to non-local addresses it is recommended to use the --transparent option instead. 

The following table should automatically drop any connections during routing which have no sockets currently listening on the local destination (that would normally be refused). Beware that this may also drop ICMP pings and similar protocols normally handled by the network stack itself, as intended, unless exceptions are configured.

-t filter -A INPUT -m socket --nowildcard -j ACCEPT
-t filter -A INPUT -j DROP

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .