Arch Linux

Gullible Jones

Member

Registered: 2004-12-29

Posts: 4,863

Rationale for allowing/disallowing RELATED connections?

My iptables rules for allowed connections used to look like this:

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT

But right now they look like this:

-A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

And as far as I can tell, everything I need still works.

From the iptables man page:

       RELATED
              meaning  that the packet is starting a new connection, but is associated with an existing connection, such as an
              FTP data transfer, or an ICMP error.

But with RELATED connections disallowed, FTP still works fine, and I still get connection errors when I should (as opposed to timeouts). So what are RELATED connections good for? What's the rationale for allowing them on a desktop - or the advantage of disallowing them?

brebs

Member

Registered: 2007-04-03

Posts: 3,742

Re: Rationale for allowing/disallowing RELATED connections?

Looks relevant for an FTP server, rather than client.

brebs

Member

Registered: 2007-04-03

Posts: 3,742

Re: Rationale for allowing/disallowing RELATED connections?

Also, I left it running with a simple test:

-A INPUT -m conntrack --ctstate RELATED -j LOG --log-level info --log-prefix "related: "

And it matches with some ICMP packets from my ADSL router. Possibly for DHCP.

Gullible Jones

Member

Registered: 2004-12-29

Posts: 4,863

Re: Rationale for allowing/disallowing RELATED connections?

Thanks. I guess I'll keep dropping RELATED packets for now, seeing as they can apparently be used to spoof valid connections.