In this lesson, you will learn how to configure the Linux firewall to safely reassemble and inspect fragmented IP packets.
The Challenge of Fragmentation
When an IP packet exceeds the Maximum Transmission Unit (MTU) of a network link, it is split into smaller fragments. Because fragments lack full transport-layer headers (like TCP ports), a standard firewall rule often cannot identify the application or session associated with the traffic. If a firewall is stateless or improperly configured, it may either block these fragments indiscriminately or, worse, allow them through without full inspection—a vulnerability often exploited in "fragmentation attacks" designed to bypass security policies.
Defragmentation in the Kernel
To maintain stateful inspection, the Linux kernel must first perform reassembly. When the netfilter system (via nftables or iptables) sees a fragment, it stores the piece in a temporary buffer until all fragments of the original packet arrive. Once reassembled into a complete packet, the firewall can properly evaluate it against your security rules.
In modern Linux systems, this reassembly is handled transparently by the connection tracking module (conntrack). You ensure this happens by including the nf_defrag_ipv4 (or ipv6) module in your networking stack.
Configuring the Policy
In nftables, you don't need a specific "reassembly" command because the integration is built into the stateful engine. However, you must ensure that your rules explicitly handle fragments to prevent bypasses. A robust approach is to drop fragments before they reach your main filter chain, or rely on conntrack to handle them:
# Ensure fragments are tracked and reassembled
nft add rule inet filter input ct state invalid drop
nft add rule inet filter input ip frag-off 0
By enforcing ct state invalid drop, you ensure that malformed or incomplete fragment sequences—which cannot be reassembled correctly—are discarded immediately. This prevents attackers from sending overlapping fragments intended to confuse the reassembly buffer or trigger resource exhaustion. Once reassembled, the packet appears to the rest of the rule set as a single, intact unit, allowing you to filter by port, protocol, or application tag without fragmentation-related gaps.
Key Takeaway: By utilizing the kernel's connection tracking module, you force fragmented traffic to undergo transparent reassembly, allowing your firewall to inspect the full, legitimate packet rather than dangerous, partial segments.