I'm currently analyzing existing iptables rulesets in order to make modifications in default policy. However, I need some help in understanding of couple rules.
$UNIVERSE is defined as
0.0.0.0/0. What are the usecases of the following rule?
# Allow any related traffic coming back to the MASQ server in. -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
What kind of related connections HTTP(S) may have? Do I really need to specify RELATED here?
# External interface, HTTP/HTTPS traffic allowed -A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT -A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT
Why do I need the following? What are usecases?
# Accept solicited tcp packets -A FORWARD -i $EXTIF -o $INTIF -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Also, when I do
lsmod I can see
nf_conntrack_ftp. Do I still have to use
-m conntrack or
UPDATE: full script is here I need to change default policy to DROP.