I'm trying work on a positive firewall and block the rest of the world with iptables. So, I've set INPUT chain default to DROP, allowing particular IPs which should have access.
iptables -P INPUT DROP iptables -I INPUT -s XXX.XXX.XXX.XXX -j ACCEPT
However, I'll have to enable connections for downloads, updates etc. From what I understand, this can be accomplished by accepting ESTABLISHED,RELATED connections via state or conntrack module. Say,
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # ---OR--- iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
At this point, I wonder if there is an alternative way of getting connections(like downloads) working without making use of a complex module like state or conntrack. If at all possible, I like to stick on with basic iptables stuff to avoid getting messy during a possible attack.
Appreciate some thoughts/inputs. Thanks!