What does RELATED and ESTABLISHED really mean.

What does RELATED and ESTABLISHED really mean.

[Michael Gale]

Hello,

	I have been reading many netfilter documents and books, they all talk about related and established connections. To use them for FTP connections and to simplify rule sets.

But none explain exactly what an ESTABLISHED or RELATED connection is ?

Here are my definitions ... please let know if these are correct :)

ESTABLISHED - This allows return packets from a connection and all proceeding packets.

Example -- you have a web server on the DMZ network.
you have the following iptables rules.

$IPT -t nat -A POSTROUTING -i $EXT_FACE -d X.X.X.X -j SNAT --to-destination 172.16.0.5

$IPT -A FORWARD -i $EXT_FACE -o $DMZ_FACE -d 172.16.0.5 -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

$IPT -A FORWARD -i $DMZ_FACE -o $EXT_FACE -s 172.16.0.5 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

This only allow a tcp connection to be setup between a out side client and a web server on the DMZ. It also only allows the web server to respond to a TCP connection on port 80 and does NOT allow the web server to initiated a outgoing TCP connection.

If I used related it would allow the web server to make a out going TCP connection to the server that made the initial inbound connection  ?

Sorry -- I hope I explained this well.

-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: What does RELATED and ESTABLISHED really mean.

[Jamie Pratt]

... straight from the packet-filtering how-to: ( 
http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.txt  )

  NEW
         A packet which creates a new connection.


      ESTABLISHED
         A packet which belongs to an existing connection (i.e., a reply
         packet, or outgoing packet on a connection which has seen
         replies).


      RELATED
         A packet which is related to, but not part of, an existing
         connection, such as an ICMP error, or (with the FTP module
         inserted), a packet establishing an ftp data connection.


regards,
jamie

Michael Gale wrote:

> Hello,
> 
> 	I have been reading many netfilter documents and books, they all talk about related and established connections. To use them for FTP connections and to simplify rule sets.
> 
> But none explain exactly what an ESTABLISHED or RELATED connection is ?
> 
> Here are my definitions ... please let know if these are correct :)
> 
> ESTABLISHED - This allows return packets from a connection and all proceeding packets.
> 
> Example -- you have a web server on the DMZ network.
> you have the following iptables rules.
> 
> $IPT -t nat -A POSTROUTING -i $EXT_FACE -d X.X.X.X -j SNAT --to-destination 172.16.0.5
> 
> $IPT -A FORWARD -i $EXT_FACE -o $DMZ_FACE -d 172.16.0.5 -p tcp --sport 1024:65535 --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
> 
> $IPT -A FORWARD -i $DMZ_FACE -o $EXT_FACE -s 172.16.0.5 -p tcp --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
> 
> This only allow a tcp connection to be setup between a out side client and a web server on the DMZ. It also only allows the web server to respond to a TCP connection on port 80 and does NOT allow the web server to initiated a outgoing TCP connection.
> 
> If I used related it would allow the web server to make a out going TCP connection to the server that made the initial inbound connection  ?
> 
> Sorry -- I hope I explained this well.
> 

--