Re: State Match Question

[Guillaume Morin <guillaume@morinfr.org>]

Hi Paul,

Dans un message du 06 jun à 15:44, Paul Dunphy écrivait :
> Could some kind soul please explain to me (or point me to information 
> about) what the difference is between filtering on state ESTABLISHED in 
> iptables and filtering on ! --syn? In other words, what's the difference 
> between saying
> 
> iptables -A FORWARD -p tcp -m state --state ESTABLISHED -j ACCEPT
> 
> and saying,
> 
> iptables -A FORWARD -p tcp ! --syn -j ACCEPT

In the first rule, you let only pass valid TCP packets correponding to a
established connection e.g a ack packet during the connection, a syn/ack
packet during the TCP handshake, a fin/ack at the end of a connection.

The second let every non SYN packet pass. That includes the packets
which are matched by the first rule of course. But invalid packets in
the sense of the connection state (a syn/ack packet without a previoous
syn packet) and packets with nasty flags (NULL, XMAS...) will pass.
That is bad. Always use the state and avoid matching yourself the TCP
flags. Matching both can be interesting e.g -m state --state NEW --syn.

HTH.

-- 
Guillaume Morin <guillaume@morinfr.org>

      A friend in need is a friend indeed. A friend who bleeds is better.
         My friend confessed, she passed the test. We will never sever.
                                   (Placebo)