In iptables context, to match a new TCP connection, one can use:

-A INPUT -p tcp --syn -m conntrack --ctstate NEW -j ACCEPT

However, is --ctstate NEW necessary provided that the --syn flag is already there? In other words, aren't --syn packets always NEW by definition and, thus, the state checking is redundant or is there any benefit in doing it? Can --syn packets be not NEW?

I've read a lot of examples and, sometimes, the state checking is dropped but in other (most) texts it's still present. Also, I found these related questions but cannot figure out a precise answer to my specific question:

Advantage of using "--syn" for matching new TCP connections


Thanks a lot.


1 Answer 1


I've always found both --syn and --ctstate NEW to be redundant because I have -m state --state INVALID -j DROP as the first rule for all the relevant chains.

The thinking is maybe you want to be a purist and follow the TCP/IP stack to the letter which means only a new connection must be --syn, i.e. you cannot send a SYN packet within an already established connection because to terminate it you must use FIN.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .