Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the practical difference between:

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT


iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Which one is best to use?

Thank you.

share|improve this question
Note that for Linux Kernel 3.7 and later, state has been removed. Only conntrack is available. – Mr. X Jan 7 '13 at 1:43
I am running 3.10.0 and state is still supported... – user181585 Jul 15 '13 at 6:16
state is deprecated in favor of conntrack, and may or may not be compiled in depending on how your kernel was built. – Michael Hampton Jul 15 '13 at 6:21
up vote 20 down vote accepted

Both use same kernel internals underneath (connection tracking subsystem).

Header of xt_conntrack.c:

xt_conntrack - Netfilter module to match connection tracking
information. (Superset of Rusty's minimalistic state match.)

So I would say -- state module is simpler (and maybe less error prone). It's also longer in kernel. Conntrack on the other side has more options and features[1].

My call is to use conntrack if you need it's features, otherwise stick with state module.

Similar question on netfilter maillist.

[1] Quite useful like "-m conntrack --ctstate DNAT -j MASQUERADE" routing/DNAT fixup ;-)

share|improve this answer

There is no difference in the outcome of those two rules. Both match extensions use the same data to match the connection tracking state. state is the "old" match extension and conntrack is newer and has a lot more options than just matching the connection tracking state.

share|improve this answer

Iptables Doc

As the documentation say:

Blockquote The conntrack match is an extended version of the state match, which makes it possible to match packets in a much more granular way. It let's you look at information directly available in the connection tracking system, without any "frontend" systems, such as in the state match. For more information about the connection tracking system, take a look at the The state machine chapter.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.