Advantage of using “--syn” for matching new TCP connections

Question

I have seen a similar technique used in several iptables examples for matching new connections:

-A INPUT -p tcp -m tcp --dport 443 --syn -m conntrack --ctstate NEW -j SSH

As seen above, TCP connections are checked against TCP flags(SYN has to be 1 and RST, ACK and FIN 0) by tcp module besides --ctstate NEW of conntrack module. Does it provide any advantage over this:

-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j SSH

My assumption is that it does because match modules are evaluated in the order they are specified in the rule and without --syn, all the TCP packets to port 443 would be passed from tcp module to conntrack module. In other words, --syn should provide this fail-fast paradigm.

Answer 1

In other words, --syn should provide this fail-fast paradigm.

That’s pretty much it. In practice, it’s the extension mechanism which is short-circuiting; the manpage says

Matches are evaluated first to last as specified on the command line and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.

In the above case, the rule uses two extensions: the tcp extension, which processes --dport and --syn, followed by the conntrack extension, which processes --ctstate. If the tcp extension fails to match, the conntrack extension will be skipped entirely.