Iptables connection tracking
Connection tracking is an essential security feature of Iptables. But, what is connection tracking?
It is the ability to maintain connection information in memory. This is new feature added in 2.4.xx Linux kernel. Eariler only commercial firewall has this feature but now it is part of Linux. It can remember connection states such as established & new connections along with protocol types, source and destination ip address. You can allow or deny access based upon state. Following are the states:
NEW – A Client requesting new connection via firewall host
ESTABLISHED – A connection that is part of already established connection
RELATED – A connection that is requesting a new request but is part of an existing connection.
INVALID – If none of the above three states can be referred or used then it is an INVAID state.
Let us try to understand four state with ftp example (our setup):
client NEW FTP Server
220.127.116.11 —> 18.104.22.168
B) Download files
> get bigfile.tar.gz
When client download files from ftp server we call it ESTABLISHED connection.
client ESTABLISHED FTP Server
Please note that when you see username/password prompt your connection get established and access to ftp server is granted upon successful authentication.
C)Passive ftp connections
In A passive ftp connection, client connection port is 20, but the trasfer port can be any unused port 1024 or higher. To enable passive mode ftp client can send pass command:
Passive mode on.
You need to use RELATED state at firewall level if you wish to allow passive ftp access. Here is an example of SSH server, allow only new and established connection for SSH server IP 22.214.171.124.
iptables -A INPUT -p tcp -s 0/0 –sport 513:65535 -d 126.96.36.199 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s 188.8.131.52 –sport 22 -d 0/0 –dport 513:65535 -m state –state ESTABLISHED -j ACCEPT
It also works with stateless protocol such as UDP. The following example allows connection tracking to forward only the packets that are associated with an established connection:
iptables -A FORWARD -m state –state ESTABLISHED,RELATED -j ALLOW
Update You may need to put following two lines in your script to use connection tracking feature: