Take the 2-minute tour ×

I would like to know what the following iptables rule does exactly ? Why is it needed ?

ACCEPT     tcp  --             state RELATED,ESTABLISHED 
share|improve this question
Belongs on superuser/serverfault... I believe it's simply accepting all established TCP connections. –  Rudi Visser Oct 20 '11 at 15:02
Yes, it just means "once the connection is open, let its packets through" –  Nemo Oct 20 '11 at 15:06
add comment

migrated from stackoverflow.com Oct 20 '11 at 15:13

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 3 down vote accepted

The ESTABLISTED state will allow all packets that are part of an existing connection to pass. The RELATED state allows new secondary connections to be made that are related to an existing connection. This would for example allow an FTP data transfer where the control connection is on port 21 and the data port is negotiated by the protocol.

share|improve this answer
add comment

It's a little bit more complex than some of the comments above suggest.

state ESTABLISHED does mean "once the connection is open, let the rest of the packets through", though it should be noted that "connection" here is defined by synchronicity: packets travelling between one known address/port pair and another known address/port pair are defined as "ESTABLISHED". The famous three-way TCP handshake doesn't enter into it.

state RELATED seems to be cargo-culted in by a lot of people without really understanding what it does. It usually includes ICMP traffic related to an existing connection (attempt), like ICMP-host-administratively-unreachable packets coming back from a firewall that's blocking your connection request to a forbidden box.

But there are also a group of kernel modules, such as nf_conntrack_ftp, that dynamically expand the definition of RELATED traffic as they are loaded (that particular one performs layer-4 examination of ftp control-channel traffic, looks for DATA statements that warn of the imminent opening of a DATA channel, and matches those packets when they arrive).

Unless you know that you need it, I recommend not allowing RELATED traffic generically, but instead restricting RELATED statements to traffic you know you want, with eg -p icmp.

share|improve this answer
Actually the connection tracking code for TCP checks sequence numbers, and packets with known address/port pair but wrong sequence numbers will be classified as INVALID instead of ESTABLISHED. See this question for an example of actual problems related to this conntrack behavior (basically, when doing NAT, the -m state --state INVALID -j DROP rule in the INPUT chain is required). –  Sergey Vlasov Oct 20 '11 at 18:03
add comment

Your Answer


