I'm trying work on a positive firewall and block the rest of the world with iptables. So, I've set INPUT chain default to DROP, allowing particular IPs which should have access.


iptables -P INPUT DROP

However, I'll have to enable connections for downloads, updates etc. From what I understand, this can be accomplished by accepting ESTABLISHED,RELATED connections via state or conntrack module. Say,

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# ---OR---
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

At this point, I wonder if there is an alternative way of getting connections(like downloads) working without making use of a complex module like state or conntrack. If at all possible, I like to stick on with basic iptables stuff to avoid getting messy during a possible attack.

Appreciate some thoughts/inputs. Thanks!

  • 1
    What do you mean by "connections for downloads, updates etc."?
    – MadHatter
    Jul 12, 2014 at 7:30
  • Setting iptables INPUT chain to DROP all connections means it won't accept incoming packets. This will leave the system in a state which it won't even ping an unknown host. This will break system updates(via yum,apt-get etc.). Or will block file downloads from Internet(Anything, say http, ftp links).
    – shad
    Jul 12, 2014 at 7:56
  • I know what you mean by refusing things you don't want; that's easy. I need you to itemise the things you do want. There is no firewall software on earth that can read your mind and decide what sort of (layer-3) traffic you have a business need for, and what you don't - you have to do that.
    – MadHatter
    Jul 12, 2014 at 8:05
  • 2
    conntrack really is not a significant worry unless you're trying to run a firewall on an ancient wristwatch or something. Even on a modern phone the overhead is minimal. Jul 12, 2014 at 13:31

1 Answer 1


Setting the chain INPUT to DROP does not break anything at all, you can still update your system (this is an OUTPUT connection) and allow file downloads (just open the port relevant to the service providing that file).

The DROP means traffic will be dropped unless there is a rule stating something else. Also, using the conntrack module is a pretty standard way of managing your iptables rules.

If the purpose of your firewall is to accept traffic only from a known group of IPs/ranges, and you want to avoid editing your rules every time that group changes, you can use an ipset.

  • 2
    I can't really understand why do you think using conntrack adds complexity to a set of rules. Also, conntrack is made to track connections. No workaround needed. You are already using the right tool.
    – dawud
    Jul 12, 2014 at 9:21
  • I'm searching if there is a workaround since using conntrack/state implies that firewall is parsed by single core. Besides, both use some messy locking inside kernel to track the state. It's working fine, but I'm thinking of improvements.
    – shad
    Jul 12, 2014 at 9:30
  • What kind of throughput are we talking about here? How many rules?
    – dawud
    Jul 12, 2014 at 9:32
  • 500+ allow rules and counting.
    – shad
    Jul 12, 2014 at 14:24
  • 1
    If you have that many rules because you need to allow traffic from many different IPs/ranges, ipsets can greatly reduce the overhead.
    – dawud
    Jul 12, 2014 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .