Beginners IPTables Question

Question

I'm currently analyzing existing iptables rulesets in order to make modifications in default policy. However, I need some help in understanding of couple rules.

$UNIVERSE is defined as 0.0.0.0/0. What are the usecases of the following rule?

# Allow any related traffic coming back to the MASQ server in.
-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m conntrack --ctstate 
   ESTABLISHED,RELATED -j ACCEPT

What kind of related connections HTTP(S) may have? Do I really need to specify RELATED here?

# External interface, HTTP/HTTPS traffic allowed
-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s 
   $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT
-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s 
   $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT

Why do I need the following? What are usecases?

# Accept solicited tcp packets
-A FORWARD -i $EXTIF -o $INTIF -m conntrack --ctstate 
      ESTABLISHED,RELATED  -j ACCEPT

Also, when I do lsmod I can see nf_conntrack and nf_conntrack_ftp. Do I still have to use -m conntrack or -m nf_conntrack?

UPDATE: full script is here I need to change default policy to DROP.

Answer 1

The first rule will accept any incoming connections on an external interface (assumed from $EXTIF), on any source address to the external IP address if the state of the packet is ESTABLISHED or RELATED. That means NEW packets won't be allowed through. The possible use-case for this is if you have a NEW packet obtained through some other rule.

You may need the RELATED state in HTTP/HTTPS for packets in TIME_WAIT, but I am not sure about this.

With your third question, the FORWARD rule is is forwarding packets to an internal interface (again, assumed), probably for a tunnel interface, another host or similar.

From what I've read, conntrack is deprecated and is now replaced by nf_conntrack, for reasons I do not know.

Answer 2

-A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

This rule allows packets entering the EXTernal IP and destined for the firewall box itself (not undergoing NAT) from anywhere as long as the state is ESTABLISHED (i.e., a reply to an outgoing packet) or RELATED (e.g., an ICMP error message regarding the original outgoing packet, like 'desination unreachable')

-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT
-A INPUT -i $EXTIF -m conntrack --ctstate NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT

NEW, ESTABLISHED, and RELATED practically covers 99% of possible packet toward ports 80 and 443. As previously, the RELATED mostly is used to match ICMP error messages.

-A FORWARD -i $EXTIF -o $INTIF -m conntrack --ctstate ESTABLISHED,RELATED  -j ACCEPT

The INPUT rule above matches packet destined to the firewall box itself. The FORWARD rule allows packets that are not destined to the firewall box itself, but to a host in the internal network. The meaning of ESTABLISHED and RELATED are the same as before.

Also, when I do lsmod I can see nf_conntrack and nf_conntrack_ftp. Do I still have to use -m conntrack or -m nf_conntrack?

Yes. The nf_conntrack and nf_conntrack_ftp modules are prerequisites for -m conntrack to work. It will be loaded automatically by iptables the first time -m conntrack is encountered.

There is no such thing as -m nf_conntrack.