Understanding connection tracking in iptables
- by Matt
I'm after some clarification of the state/connection tracking in iptables.
What is the difference between these rules?
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Is connection tracking turned on when a packet is first matched containing -m state --state BLA , or is connection tracking always on?
Can/Should connection state be used for fast matching like below?
e.g. suppose this is some sort of router/firewall (no nat).
# Default DROP policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Drop invalid
iptables -A FORWARD -m state --state INVALID -j DROP
# Accept established,related connections
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow ssh through, track connection
iptables -A FORWARD -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
