Iptables – tcp flags in iptables: What’s the difference between RST SYN and RST and SYN RST ? When to use ALL

firewallflagsiptablestcp

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions.
The rule: 

-p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP

First argument says check packets with flag SYN
Second argument says make sure the flags ACK,FIN,RST SYN are set
And when that's the case (there's a match), drop the tcp packet

First question:
I understand the meaning of RST and RST/ACK but in the second argument RST SYN is being used.
What's the difference between RST SYN and RST and SYN RST ?
Is there a "SYN RST" flag in a 3 way handshake ?

Second question is about the difference between 

-p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP

and 

-p tcp --tcp-flags ALL SYN,ACK,FIN,RST SYN -j DROP

When should ALL be used ?
When I use ALL, does that mean if the tcp packet with the syn flag doesn't have the ACK "and" the FIN "and" the RST SYN flags set, there will be no match ?

Best Answer

This:

-p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP

means "look at the flags syn, ack, fin and rst and match the packets that have the flag SYN set, and all the other unset"

The first argument of tcp-flags is the flags your are considering, the second argument is the mask you want to match. if you were using

--tcp-flags SYN,ACK SYN

then it would match packets that have [SYN=1 ACK=0], but it would not match packets that have [SYN=1,ACK=1] or [SYN=0,ACK=1] or [SYN=0,ACK=0]

In your rule above, you are matching SYN packets only.

Related Topic