1

When using the following rule:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 

...do you need to add specific rules including the NEW states to allow for an ESTABLISHED connection?

Like so:

iptables -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT 

...or are established connections made simply by ACCEPTING them?

I've read several tutorials on this, and I can't find this clarification anywhere.

2 Answers 2

1

Usually the NEW state will be used to filter cases you don't wont to see as the first packet of a stream.

For instance :

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

Will drop everything that doesn't look like a valid TCP SYN packet.

If your use case is to allow the world to connect to your server port 443, allow your server to reply and the connection to be established then you need to add the second rule but the NEW state is not mandatory.

So your configuration could either be :

iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT 

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Or

iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT 

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Or (better)

iptables -P INPUT DROP
iptables -P OUTPUT DROP

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT 

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
0
0

It would be enough to just do:

iptables -A INPUT -p tcp --dport 443 -j ACCEPT 

Of course, for not accepting connections you already need to have either the policy set to DROP or to have a rule to DROP everything else.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .