In iptables I drop all incoming traffic. But I want e.g. PING to work when sent to the blocked addresses.
What works is if I allow ESTABLISHED. But this also allows existing (=established) connections to continue even if the iptables rules say they should be blocked/dropped.
In man iptables:
ESTABLISHED meaning that the packet is associated with a connection which has seen packets in both directions
I don't see any better state to identify connection which just received first packet in the second direction - first reply to an outgoing request.
Is there a way to set rules for these "newly established" connections?
Maybe NEW could be somehow used on the outgoing connection to allow incoming packets on it?
UPDATE: Since i can't express the intent otherwise:
I wish to implement a whitelist, so a few specific addresses should be able to connect, others should be dropped. So i have:
iptables -A INPUT -s 126.96.36.199,188.8.131.52 -j ACCEPT iptables -P INPUT DROP
But this also blocks reply traffic, so if this computer sends a ping to the whitelisted addresses, it will not receive a reply. That is why i added the ESTABLISHED rule, which fixes that problem:
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
But this introduces another problem: if a connection existed before applying these rules from a non-whitelisted addresss 184.108.40.206, it will be allowed to continue.
How can I allow reply traffic without allowing existing connection that should be blocked by the iptables rules?