2

I would like to know what the following iptables rule does exactly ? Why is it needed ?

ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
quanta
  • 50,327
  • 19
  • 152
  • 213
Sangfroid
  • 187
  • 3

2 Answers2

3

The ESTABLISTED state will allow all packets that are part of an existing connection to pass. The RELATED state allows new secondary connections to be made that are related to an existing connection. This would for example allow an FTP data transfer where the control connection is on port 21 and the data port is negotiated by the protocol.

user9517
  • 114,104
  • 20
  • 206
  • 289
3

It's a little bit more complex than some of the comments above suggest.

state ESTABLISHED does mean "once the connection is open, let the rest of the packets through", though it should be noted that "connection" here is defined by synchronicity: packets travelling between one known address/port pair and another known address/port pair are defined as "ESTABLISHED". The famous three-way TCP handshake doesn't enter into it.

state RELATED seems to be cargo-culted in by a lot of people without really understanding what it does. It usually includes ICMP traffic related to an existing connection (attempt), like ICMP-host-administratively-unreachable packets coming back from a firewall that's blocking your connection request to a forbidden box.

But there are also a group of kernel modules, such as nf_conntrack_ftp, that dynamically expand the definition of RELATED traffic as they are loaded (that particular one performs layer-4 examination of ftp control-channel traffic, looks for DATA statements that warn of the imminent opening of a DATA channel, and matches those packets when they arrive).

Unless you know that you need it, I recommend not allowing RELATED traffic generically, but instead restricting RELATED statements to traffic you know you want, with eg -p icmp.

MadHatter
  • 78,442
  • 20
  • 178
  • 229
  • Actually the connection tracking code for TCP checks sequence numbers, and packets with known address/port pair but wrong sequence numbers will be classified as INVALID instead of ESTABLISHED. See [this question](http://serverfault.com/q/309691/63156) for an example of actual problems related to this conntrack behavior (basically, when doing NAT, the `-m state --state INVALID -j DROP` rule in the `INPUT` chain is **required**). – Sergey Vlasov Oct 20 '11 at 18:03