Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 6 down vote favorite
2

Part of a firewall on a server :

iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 10 -j DROP

When I search online I always see NEW being used in that rule but I'm having a hard time understanding why ESTABLISHED and RELATED aren't being used.

Like this :

iptables -A INPUT -p tcp --dport 22 -m state NEW,ESTABLISHED,RELATED --state -m recent --set

iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -m recent --update --seconds 100 --hitcount 10 -j DROP

Can someone explain to me when exactly a NEW packet changes into ESTABLISHED and RELATED ?

share|improve this question

1 Answer

up vote 9 down vote accepted

Consider a NEW packet a telephone call before the receiver has picked up. An ESTABLISHED packet is their, "Hello." And a RELATED packet would be if you were calling to tell them about an e-mail you were about to send them. (The e-mail being RELATED.)

In case my analogy isn't so great, I personlly think the man pages handles it well:

NEW -- meaning that the packet has started a new connection, or otherwise associated with a connection which has not seen packets in both directions, and

ESTABLISHED -- meaning that the packet is associated with a connection which has seen packets in both directions,

RELATED -- meaning that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error.

iptables(8) - Linux man page

share|improve this answer
Out of curiousity, do you know how it determines RELATED packets? Is there some mechanism that applications can use to signal to iptables that a connection will be a related connection, or is it purely part of the stateful part of iptables? – Matthew Scharley Mar 19 '12 at 22:22
4  
It's handled by a series of kernel modules called ip_conntrack_*, each written for a particular protocol that uses unrelated connections (such as FTP). To answer your question, I think you would need to load a similar module for your application. – Kyle Smith Mar 19 '12 at 22:34
Ok, thank you. But going back to the rule with NEW in it, isn't it possible a packet can be made to look like it's already ESTABLISHED and is therefor not blocked by the rule ? – Kris Mar 20 '12 at 8:13
1  
@Kris: It's pretty hard to fake outgoing packets, so by the wording of the man page in the answer, I don't see how. You are correct that it's possible to fake a packet which looks like it's bound for an open connection, but even without a firewall, the TCP stack would just drop the packet on the floor if it didn't already know about an open connection from the sender. If this is on a firewall on a router, it's still possible to maintain this state by inspecting SYN/ACK/RST/etc packets as they pass through the router, and I'd expect iptables to do this. – Matthew Scharley Mar 21 '12 at 2:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.