Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
# /sbin/iptables -nvL

The output of above iptables command look something like this...

 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *           tcp dpt:3306 state NEW,RELATED,ESTABLISHED 
16810 1009K ACCEPT     tcp  --  *      *           tcp dpt:3306 

What is the difference between these 2 lines? The second IP does not has the "state New,...". Does that make any difference? What all I am trying to do is allow mysql access from these IP's on default port 3306

share|improve this question
up vote 3 down vote accepted

It's related to the -m state match on the iptables rule. You can use iptables-save to see the complete rule.

state NEW,RELATED,ESTABLISHED means only these three will be accepted.

iptables (or, more precisely, netfilter) knows about the following states:

  • NEW - new connection
  • ESTABLISHED - two-way traffic detected
  • RELATED - traffic related to the original connection (e.g., ICMP reply related to a TCP connection)
  • INVALID - traffic is invalid, e.g., a misopportune TCP segment was received
  • UNTRACKED - traffic is not tracked by netfilter's conntrack module

As to your question: there's practically no difference between the two rules.

share|improve this answer

The difference is the source IP address and the state flags as you mentioned.

As to why your first IP is not connecting or not able to connect, when you use connection tracking in iptables you typically have a rule like:

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

as the catchall.

The .101 rule would be just NEW.

ACCEPT tcp -- anywhere state NEW tcp dpt:306

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.