Connection Protocol in the state?

Connection Protocol in the state?

[Christoph Paasch]

Hello,

I would like to know, that if I have a filter like the one shown below 
(allowing outgoing connections of every protocol-type), does netfilter stores 
in the state of the established outgoing connection also the protocol which 
established the connection? (TCP, UDP, ....) Or does it opens the connection 
for any protocol?

iptables -A FORWARD -i eth0 --ctstate NEW, RELATED, ESTABLISHED -j ACCEPT


Thanks in advance

-- 
Christoph Paasch

www.rollerbulls.be
--

Re: Connection Protocol in the state?

[Jan Engelhardt]

On Wednesday 2008-10-01 16:06, Christoph Paasch wrote:
>
>I would like to know, that if I have a filter like the one shown below 
>(allowing outgoing connections of every protocol-type), does netfilter stores 
>in the state of the established outgoing connection also the protocol which 
>established the connection? (TCP, UDP, ....) Or does it opens the connection 
>for any protocol?
>
>iptables -A FORWARD -i eth0 --ctstate NEW, RELATED, ESTABLISHED -j ACCEPT

Read the really-really-really-nice manpage (which has gotten so much care
from me). I mean, hey, it's directly below --ctstate! :-)

       [!] --ctproto l4proto
              Layer-4 protocol to match (by number or name)

Re: Connection Protocol in the state?

[Christoph Paasch]

Hello,

>
> Read the really-really-really-nice manpage (which has gotten so much care
> from me). I mean, hey, it's directly below --ctstate! :-)
>
>        [!] --ctproto l4proto
>               Layer-4 protocol to match (by number or name)

Hmm... so, you mean that the established connection doesn't makes the 
difference between the different protocols, as long as those aren't specified 
with "--ctproto".

So, if I got an established TCP-connection, I can do run any other protocol 
(UDP, ... and in particular shim6 ;-) in any direction. And also on any port 
number? 

Sorry, but I think, that it's not clear, what is stored in the state, of a 
connection, if the iptables rule doesn't specifies the protocol, portnumber, 
...

Thanks for answering, and have a nice day...

Christoph Paasch

Re: Connection Protocol in the state?

[Jan Engelhardt]

On Sunday 2008-10-05 04:51, Christoph Paasch wrote:
>Hello,
>
>>
>> Read the really-really-really-nice manpage (which has gotten so much care
>> from me). I mean, hey, it's directly below --ctstate! :-)
>>
>>        [!] --ctproto l4proto
>>               Layer-4 protocol to match (by number or name)
>
>Hmm... so, you mean that the established connection doesn't makes
>the difference between the different protocols, as long as those
>aren't specified with "--ctproto".

Correct, -m conntrack is naturally protocol-independent.
You can use either -p tcp or --ctproto tcp to check for
protocol-specific parts. Note that -p and --ctproto have different
meaning, but I have yet to see a connection tracker that puts, say,
non-tcp packets into a tcp connection.

>So, if I got an established TCP-connection, I can do run any other protocol 
>(UDP, ... and in particular shim6 ;-) in any direction. And also on any port 
>number? 

You will never see the SHIM layer if you are doing filtering at
layer-3 (which is what ip6tables does).

>Sorry, but I think, that it's not clear, what is stored in the state, of a 
>connection, if the iptables rule doesn't specifies the protocol, portnumber, 

connection = (srcip, dstip, l4stuff)
l4stuff#tcp= (srcport, dstport)