0

What is the difference in an iptable rule when i don't a state? E.g.

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

What's the default state (if any) in the second rule?

Improve this question
1
  • state is deprecated and replaced by conntrack which supports mostly the same flags...
    – Ginnungagap
    Aug 27, 2019 at 22:00

2 Answers 2

Reset to default
0

There isn't a default state value. If the state match missed in the rule, the state value isn't checked. This logic is applied to any iptables match (addresses, protocols, port numbers, interfaces etc).

So, the difference between these two rules is in that, what the second rule matches and accept all the input packets to port tcp/22 (standard ssh service port number). First rule matches only first (initial) incoming packets of connections to ssh port, but not next packets.

To get the introduction to the related netfilter/iptables concepts read the iptables tutorial:

Improve this answer
4
  • Many thanks. Just clarification. If NEW only accepts the first packet and not next packet, what does it mean that the connection will never be established? What's the point of NEW then?
    – toto'
    Aug 25, 2019 at 8:44
  • Please follow the second link and read the documentation. There isn't a reason to reword same information many times. General case of usage of the new state match is reduce the number of rules, through those the packets pass. First rule is the -m state --state ESTABLISHED,RELATED -j ACCEPT. Other rules is the -m state --state NEW -j ACCEPT. So the most part of packets is accepted by first rule, but only small part of packets is accepted by the next rules, those allow the first packets of connections. This way improves the performance.
    – Anton Danilov
    Aug 25, 2019 at 9:31
  • Ok so after the first packet is accepted from NEW rule then the state goes in the ESTABLISHED rule, am i correct?
    – toto'
    Aug 25, 2019 at 12:06
  • Yep, in a normal case the next packets will have the ESTABLISHED state, but not always. Also the packets can have the INVALID state. There are other states like RELATED,SNAT,DNAT,ASSURED etc.
    – Anton Danilov
    Aug 25, 2019 at 12:12
0

The --state NEW will only match new connection, if it is TCP packet, it match SYN packet.

If you don't have a rule like

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

The --state NEW rule will not match the packet after TCP SYN handshake.

For more detail: iptables doc

Improve this answer
2
  • This is a bit inprecise. If the --state ESTABLISHED rule is added, then the following packets of the TCP connection will match this rule. The packets will not match the --state NEW rule. The --state NEW rule matches only the TCP SYN packet.
    – Tero Kilkanen
    Aug 25, 2019 at 8:33
  • Ok but I may be wrong to say what's the point of NEW, if only accepts the first packet, the connection won't never be established anyway !?
    – toto'
    Aug 25, 2019 at 8:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .