I've often seen the rule
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT applied. Whilst I'm not an expert, that particular line concerns me. It's pretty obvious that the rule allows all traffic with the only exception that the connection has to have been established or related to an established connection.
- I'll allow connections to the default SSH port
22from the servers LAN in the subnet
SuperInsecureApp®exposes something on port
1337, which I add to my
- I've added the
conntrackrule to accept
RELATEDfrom all sources
- Chain policy is
So basically that configuration shoud allow SSH-connections from the LAN only, whilst allowing inbound traffic on port 1337 from world.
This is where my confusion blooms. Would the
conntrack in any way expose a security flaw that would allow one to get an established connection on 1337 (since it's world open), and then utilize that connection to gain access to the SSH port (or any other port for that matter)?