Consider these two sets of rules:
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
Previously I was under the impression that the two were functionally the same, however someone recently remarked to me:
To have an ESTABLISHED,RELATED connection you have to have a rule that add the connection into the db that this rule looks at. This is done with the NEW rule. Once the connection is accepted it is placed into the db so the ESTABLISHED,RELATED rules can match against it. Without the NEW rules nothing is laced into the db and thus ESTABLISHED,RELATED will never match anything.
So I admit I'm a bit confused as to how the internals of
iptables operate, exactly how does
iptables go about tagging packets based on the packet state?