Firewall – Difference Between NEW, ESTABLISHED, and RELATED Packets in iptables

firewalliptablespacket

Part of a firewall on a server :

iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 10 -j DROP

When I search online I always see NEW being used in that rule but I'm having a hard time understanding why ESTABLISHED and RELATED aren't being used.

Like this :

iptables -A INPUT -p tcp --dport 22 -m state NEW,ESTABLISHED,RELATED --state -m recent --set

iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -m recent --update --seconds 100 --hitcount 10 -j DROP

Can someone explain to me when exactly a NEW packet changes into ESTABLISHED and RELATED ?

Best Answer

Consider a NEW packet a telephone call before the receiver has picked up. An ESTABLISHED packet is their, "Hello." And a RELATED packet would be if you were calling to tell them about an e-mail you were about to send them. (The e-mail being RELATED.)

In case my analogy isn't so great, I personlly think the man pages handles it well:

NEW -- meaning that the packet has started a new connection, or otherwise associated with a connection which has not seen packets in both directions, and

ESTABLISHED -- meaning that the packet is associated with a connection which has seen packets in both directions,

RELATED -- meaning that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error.

iptables(8) - Linux man page

Related Topic