I am looking for a way to get a context/status in iptables-rules. I am not talking about he context of a session here (new, established, ...).


Request to port 80                  => PASS + set CONTEXT to 1
Request to port 88 and CONTEXT is 1 => PASS

So a mechanism that is a sort of simple memory of the past.

Is that possible with an existing extension?


The recent match (which as an iptables match is quite non-standard: it can be used either to check or to alter the information) could be used for your purpose:

iptables -A INPUT -p tcp --dport 80 -m recent --set --name contextA -j ACCEPT
iptables -A INPUT -p tcp --dport 88 -m recent --rcheck --name contextA -j ACCEPT

Now more plumbing is certainly needed, including the use of options like --seconds or additional rules with option --remove or the "context" will stay forever set. It all depends on the actual untold goal you're after.

For more complex settings, interfacing iptables with ipset using set match and SET target can probably help (it's a superset of recent).

If you need this for port knocking, there is a specific pknock match available with xtables-addons (which usually requires compiling, since it's coming with external kernel modules), but then also consider tools like fwknop.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.