Iptables, what's the difference between -m state and -m conntrack?

Question

What's the practical difference between:

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

and

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Which one is best to use?

Thank you.

Answer 1

Both use same kernel internals underneath (connection tracking subsystem).

Header of xt_conntrack.c:

xt_conntrack - Netfilter module to match connection tracking
information. (Superset of Rusty's minimalistic state match.)

So I would say -- state module is simpler (and maybe less error prone). It's also longer in kernel. Conntrack on the other side has more options and features[1].

My call is to use conntrack if you need it's features, otherwise stick with state module.

Similar question on netfilter maillist.

[1] Quite useful like "-m conntrack --ctstate DNAT -j MASQUERADE" rounting/DNAT fixup ;-)

Answer 2

There is no difference in the outcome of those two rules. Both match extensions use the same data to match the connection tracking state. state is the "old" match extension and conntrack is newer and has a lot more options than just matching the connection tracking state.

Answer 3

Note that for Linux Kernel 3.7 and later, state has been removed. Only conntrack is available.