Connection states information tables

Connection states information tables

[Lorenzo Rossi]

Hi,
i have a question concerning the tables where are maintained the
informations about the connections state.
I configured my firewall script with the following lines, to permit
the SSH traffic originated from the protected zone to go to Internet.

iptables -A TCP_IN -i $INTERFACE -p tcp --sport 22 -m state --state
ESTABLISHED -J ACCEPT

iptables -A TCP_OUT -o $INTERFACE -p tcp --dport 22 -m state
--state NEW,ESTABLISHED -j ACCEPT

The custom chain TCP_IN is listed in the default INPUT chain.
The custom chain TCP_OUT is listed in the dafault OUTPUT chain.
The dafault policy for the INPUT and OUTPUT chains, as you can
imagine, is to DROP.

My question is:
How many state tables are used? one table for each main chain?
One for INPUT and one for OUTPUT?

I'm a bit confused..... :)

Thanks
Lorenzo

Re: Connection states information tables

[Aleksandar Milivojevic]

Lorenzo Rossi wrote:
> My question is:
> How many state tables are used? one table for each main chain?
> One for INPUT and one for OUTPUT?

Only one table is used, regardless of how many tables and/or chains you 
have.  Everything goes into that one table.  Having separate tables, one 
for each chain, wouldn't be of much use (than you couldn't match 
incoming and outgoing packets of single connection, unless you traverse 
all those tables which is just the same as having one table).

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

RE: Connection states information tables

[Daniel Chemko]

> My question is:
> How many state tables are used? one table for each main chain?
> One for INPUT and one for OUTPUT?

The STATE is maintained by the ip_conntrack module. It uses one big list
to maintain the current state of all active sessions through the system.
Run cat /proc/net/ip_conntrack to see the human readable version of this
list.