I am just getting started with iptables and stumbled across something I don't really understand.
FYI, I followed the instructions of Ubuntu wiki's IptablesHowTo.
The nat and mangle tables are empty, I'm only working with the filter table right now.
If I add the following iptables rules:
iptables -A INPUT -p tcp --dport ssh -j ACCEPT iptables -A INPUT -j DROP
... then I still have access to my machine via ssh, however all iptables commands take about a minute or two to run. It's not a DNS problem,
-n doesn't change it.
If I flush the table and add these three rules instead, everything is working fine:
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT iptables -A INPUT -j DROP
Can someone explain to me, why the first rule has such a great impact on iptables? I understand that it allows established sessions to receive traffic, but why do I need it if ssh is open?