Re: Problems with OUTPUT rules ESTABLISHED,RELATED

[Peter Volkov Alexandrovich <pvolkov@mics.msu.su>]

Hi, again.

On Втр, 2005-08-02 at 15:58 -0500, John Lange wrote:
> Perhaps you can help clarify this for me?

Perhaps. :) But be aware that I'm not a TCP guru. ;)

May be somebody from netfilter mailing list point us to the right
documentation. The general question is at which points of the packet
traversal diagram the connection tracking code changes its state? Or in
which chain/tables syn,ack packet is the part of ESTABLISHED connection?

> According to http://www.knowplace.org/netfilter/ip_overview.html , the
> handshake procedure is as follows:
> 
> 1. (B) --> [SYN] --> (A)
> 2. (B) <-- [SYN/ACK] <--(A)
> 3. (B) --> [ACK] --> (A)
> 
> I read it as meaning that up until the end of step 2 the connection
> would be NEW. At the end of Step 2 and beyond the connection would be
> ESTABLISHED.
> 
> A packet with just the "ACK" flag set can only be part of an established
> connection. quote "The important thing to note here is that after the
> three-way handshake is completed, and the connection is complete, every
> packet that is part of this TCP connection will always have the ACK bit
> set."
> 
> So, my understanding is the only way a packet could be generated with
> the ACK flag set and the SRC as my server's IP is as part of an
> established connection.
> 
> If that is the case then it should not be blocked because I have an
> OUTPUT rule  which allows it.

TCP connection states are not the same as iptables connection states.
And connection tracking code think that connection is ESTABLISHED only
after step 2. But (I hope :)) packet should pass connection tracking
code BEFORE it get INPUT or OUTPUT chain and thus connection should be
at the ESTABLISHED state in this chains. Thus setting just ESTABLISHED
should be Ok.

> Where am I going wrong here?
> 
> If I do:
> 
> iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> 
> Then all outbound packets are allowed so I definitely don't want that.

I think your problem is in the following rule:

iptables -A INPUT -p tcp --syn --dport 80 -j ACCEPT

change it on

iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

Please tell me if this works for you.

Peter.