2

I have seen a similar technique used in several iptables examples for matching new connections:

-A INPUT -p tcp -m tcp --dport 443 --syn -m conntrack --ctstate NEW -j SSH

As seen above, TCP connections are checked against TCP flags(SYN has to be 1 and RST, ACK and FIN 0) by tcp module besides --ctstate NEW of conntrack module. Does it provide any advantage over this:

-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j SSH

My assumption is that it does because match modules are evaluated in the order they are specified in the rule and without --syn, all the TCP packets to port 443 would be passed from tcp module to conntrack module. In other words, --syn should provide this fail-fast paradigm.

2

In other words, --syn should provide this fail-fast paradigm.

That’s pretty much it. In practice, it’s the extension mechanism which is short-circuiting; the manpage says

Matches are evaluated first to last as specified on the command line and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.

In the above case, the rule uses two extensions: the tcp extension, which processes --dport and --syn, followed by the conntrack extension, which processes --ctstate. If the tcp extension fails to match, the conntrack extension will be skipped entirely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.