Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm currently analyzing existing iptables rulesets in order to make modifications in default policy. However, I need some help in understanding of couple rules.

$UNIVERSE is defined as 0.0.0.0/0. What are the usecases of the following rule?

# Allow any related traffic coming back to the MASQ server in.
-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m conntrack --ctstate 
   ESTABLISHED,RELATED -j ACCEPT

What kind of related connections HTTP(S) may have? Do I really need to specify RELATED here?

# External interface, HTTP/HTTPS traffic allowed
-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s 
   $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT
-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s 
   $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT

Why do I need the following? What are usecases?

# Accept solicited tcp packets
-A FORWARD -i $EXTIF -o $INTIF -m conntrack --ctstate 
      ESTABLISHED,RELATED  -j ACCEPT

Also, when I do lsmod I can see nf_conntrack and nf_conntrack_ftp. Do I still have to use -m conntrack or -m nf_conntrack?

UPDATE: full script is here I need to change default policy to DROP.

share|improve this question
add comment

2 Answers 2

The first rule will accept any incoming connections on an external interface (assumed from $EXTIF), on any source address to the external IP address if the state of the packet is ESTABLISHED or RELATED. That means NEW packets won't be allowed through. The possible use-case for this is if you have a NEW packet obtained through some other rule.

You may need the RELATED state in HTTP/HTTPS for packets in TIME_WAIT, but I am not sure about this.

With your third question, the FORWARD rule is is forwarding packets to an internal interface (again, assumed), probably for a tunnel interface, another host or similar.

From what I've read, conntrack is deprecated and is now replaced by nf_conntrack, for reasons I do not know.

share|improve this answer
    
It's confusing because for first rule I don't see any other rule for NEW, which may related to that rule... for the second, will be waiting for other opinions. For third - I don't have any tunnel, neither rules for tunnel. nf_contrack - still don't have an answer. Thanks –  Michael Mar 11 '11 at 9:38
    
May I know where you obtained these rules from? With the third rule, you could also just be forwarding it to another host. –  atx Mar 11 '11 at 9:41
    
@malfy: it was setup by someone who is no more maintaing it. There is no other host in the network. There is one server itself based on Ubuntu and number of dynamic clients. Nothing requires forwarding. –  Michael Mar 11 '11 at 9:47
    
Then you can get rid of that rule. Which interface is $INTIF? –  atx Mar 11 '11 at 9:49
    
@malfy: to be more precise and as there are not many rulesets, here is the full script: pastebin.com/bbCbnMjY –  Michael Mar 11 '11 at 9:52
show 6 more comments
-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

This rule allows packets entering the EXTernal IP and destined for the firewall box itself (not undergoing NAT) from anywhere as long as the state is ESTABLISHED (i.e., a reply to an outgoing packet) or RELATED (e.g., an ICMP error message regarding the original outgoing packet, like 'desination unreachable')

-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT
-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT

NEW, ESTABLISHED, and RELATED practically covers 99% of possible packet toward ports 80 and 443. As previously, the RELATED mostly is used to match ICMP error messages.

-A FORWARD -i $EXTIF -o $INTIF -m conntrack --ctstate ESTABLISHED,RELATED  -j ACCEPT

The INPUT rule above matches packet destined to the firewall box itself. The FORWARD rule allows packets that are not destined to the firewall box itself, but to a host in the internal network. The meaning of ESTABLISHED and RELATED are the same as before.

Also, when I do lsmod I can see nf_conntrack and nf_conntrack_ftp. Do I still have to use -m conntrack or -m nf_conntrack?

Yes. The nf_conntrack and nf_conntrack_ftp modules are prerequisites for -m conntrack to work. It will be loaded automatically by iptables the first time -m conntrack is encountered.

There is no such thing as -m nf_conntrack.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.