I'm trying to run a simple Debian server, and I'm using iptables to set up the firewall. I'm aware that most TCP connections migrate ports once they are established, so I've included:
-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
However after experimenting with:
-A INPUT -j LOG
I've noticed that once these TCP connections migrate, they mysteriously become udp. I tried adding:
-A INPUT -p udp -j ACCEPT
And suddenly I can get responses from curl, docker pull, and apt update. Why does this happen, and is there any way to deal with this other than just leaving all udp ports open? Can udp packets be RELATED or ESTABLISHED?