I have seen a similar technique used in several iptables
examples for matching new connections:
-A INPUT -p tcp -m tcp --dport 443 --syn -m conntrack --ctstate NEW -j SSH
As seen above, TCP connections are checked against TCP flags(SYN has to be 1 and RST, ACK and FIN 0) by tcp
module besides --ctstate NEW
of conntrack
module. Does it provide any advantage over this:
-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -j SSH
My assumption is that it does because match modules are evaluated in the order they are specified in the rule and without --syn
, all the TCP packets to port 443 would be passed from tcp
module to conntrack
module. In other words, --syn
should provide this fail-fast paradigm.