4

Consider these two sets of rules:

Set A

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -j REJECT
-A OUTPUT -j ACCEPT

Set B

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -j REJECT
-A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT

Previously I was under the impression that the two were functionally the same, however someone recently remarked to me:

To have an ESTABLISHED,RELATED connection you have to have a rule that add the connection into the db that this rule looks at. This is done with the NEW rule. Once the connection is accepted it is placed into the db so the ESTABLISHED,RELATED rules can match against it. Without the NEW rules nothing is laced into the db and thus ESTABLISHED,RELATED will never match anything.

So I admit I'm a bit confused as to how the internals of iptables operate, exactly how does iptables go about tagging packets based on the packet state?

6

Without the NEW rules nothing is laced into the db and thus ESTABLISHED,RELATED will never match anything.

This is false.

There are five userland states (there are more in kernel space), and while an ESTABLISHED or RELATED connection does logically need to begin with a NEW packet, you do not need any explicit NEW rule to produce such a connection (you do need an explicit ACCEPT which implicitly includes NEW packets, however). Follow the logic and consider the other four states first, eg.:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state INVALID -j REJECT --reject-with icmp-net-prohibited
-A INPUT -m state --state INVALID -j REJECT --reject-with icmp-net-prohibited

I've left out NOTRACK since that can only exist because of a previous iptables rule. Guess what's left after these rules have been applied? Only NEW packets. You can now sort those however you want. It will work, I promise, and note: with no NEW rules at all. None.

Exactly how does iptables go about tagging packets based on the packet state?

According to the previous reference, a connection is established once a reply has been sent. The nature of the protocol evidently comes into play here a bit (the kernel applies those rules too); e.g. when a NEW SYN TCP packet is accepted a SYN/ACK is sent in reply and the connection is ESTABLISHED; following a final FIN/ACK it is defunct.

How a connection is considered RELATED evidently depends further on the protocol involved; basically it relates to connections to/from hosts that already have an ESTABLISHED connection. Notice that you must sometimes load special modules (e.g., for ftp) in order to get this to work.

  • 1
    Perfect answer, comprehendable and well referenced, thanks a lot – AlexH Feb 20 '14 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.