Re: IPTables State Tracking

[Chris Brenton <cbrenton@chrisbrenton.org>]

Greetings Josh,

Josh.Berry@compucom.com wrote:
>
> Does IPTables track virtual state of ICMP and UDP packets? 

That it does.

> I know that
> UDP and ICMP are not stateful connections, but does IPTables perform
> pseudo-stateful tracking of these connections such as some other
> firewalls that basically timeout UDP/ICMP connections after a specific
> time?

ICMP gets a bit more complex than that. You can do this for things like 
Echo-requests, time request, subnet mask requests, etc. as the source 
and destination remains constant. You can also predict the transport and 
type/codes used in the response. This is referred to as traffic that is 
part of a previously "established" session.

When you get into ICMP type 3's and 11's however (host unreachables, TTL 
exceeded, etc.) you get a bit of a problem as the system transmitting 
these packets is usually _not_ the host you sent the original packet to. 
Usually its some router or firewall along the path of the connection. 
Also, the packet type to some extent is unexpected (you transmitted TCP 
or UDP and now you are getting back an ICMP packet from some 
unidentified host).

Both of these packet types store 28 bytes in the payload which 
identifies the original packet that generated the error (like the TCP or 
UDP example above). A good firewall (like iptables) can use this payload 
information to determine if the packet should be allowed through or not.

So these ICMP error packets are not part of the original session, but 
they were generated because of it. For this reason it is referred to as 
"related" traffic.

So the good news is yes, iptables will easily handle established and 
related traffic. The better news is that you have the flexibility to 
handle them independently and do what ever you want with either.

Note that when you are comparing firewalls you really have to look at 
the vendor implementation. For example there are a number of firewalls 
on the market that claim to be based on stateful inspection, and for 
some protocols they actually are, but for type 3's and 11's they fall 
back on rudimentary packet filtering (let them all in including the 
bogus ones, or none at all).

HTH,
C