1

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7010 -j ACCEPT

I trying to understand the -m state --state NEW part.

Searching through the man pages and correct me if I am wrong the

  • NEW meaning that the packet has started a new connection, or otherwise associated with a connection which has not seen packets in both directions

  • -m = match

  • --state, where state is a comma separated list of the connection states to match. Possible states are INVALID meaning that the packet could not be identified for some reason which includes running out of memory and ICMP errors which don't correspond to any known connection, ESTABLISHED meaning that the packet is associated with a connection which has seen packets in both directions, NEW meaning that the packet has started a new connection, or otherwise associated with a connection which as not seen packets in both directions, and RELATED meaing that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error. UNTRACKED meaning that the packet is not tracked at all, which happens if you use the NOTRACK target in raw table.

My question is: what is the difference between these two commands

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7010 -j ACCEPT 
iptables -A INPUT  -p tcp --dport 7000:7010  -j ACCEPT 
1

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7010 -j ACCEPT

This is using a stateful firewall technique. With this, iptables track the state of every connection such as NEW, ESTABLISHED, RELATED to name a few.

NEW is the state of the connection when it is first sourced whether from the local interface or other machines trying to connect to your box, as described in the man page.

ESTABLISHED is when the packet is acknowledge by the destination host. Therefore the packet is seen in both directions.

With Stateful firewall technique, you'll have more control but fewer line of codes when you need to add more firewall rules.


iptables -A INPUT -p tcp --dport 7000:7010 -j ACCEPT

This rule simply allows NEW inbound connection in the INPUT chain of iptables to port 7000:7010 but not tracking the state of the packet for later use.

More about stateful firewall: http://en.wikipedia.org/wiki/Stateful_firewall

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.