2

I've been reading about states in iptables.

This page says

A connection is considered RELATED when it is related to another already ESTABLISHED connection. What this means, is that for a connection to be considered as RELATED, we must first have a connection that is considered ESTABLISHED. The ESTABLISHED connection will then spawn a connection outside of the main connection. The newly spawned connection will then be considered RELATED, if the conntrack module is able to understand that it is RELATED.

Supposing a httpd connection is allowed by iptables on tcp port A (eg http://www.example.com:8001). The response from the webserver is a 302 redirect instructing the browser to go to a URL on tcp port B on the same server (eg http://www.example.com:8002).

Is iptables 'aware' of this relationship, and treat packets on the new connection with state RELATED. Or does iptables consider it a new connection and treat the packets with state NEW?

4

No. the http REDIRECT indicates the client that the searched page is now at an other address (maybe in the same host, maybe not).

iptables RELATED indicates related connections (usually in parallel, or as reply), and not a new initiated connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.