IPTables: Difference between revisions

← Older edit

VisualWikitext

Revision as of 20:01, 12 September 2018 view source Root (talk \| contribs) Bureaucrats, Interface administrators, Administrators 1,956 edits No edit summary Tag: Visual edit: Switched ← Older edit		Latest revision as of 21:16, 12 September 2018 view source Root (talk \| contribs) Bureaucrats, Interface administrators, Administrators 1,956 edits No edit summary Tag: Visual edit
Line 170:		Line 170:


	-m state		-m or --match state --state

	The NEW state tells us that the packet is the first packet that we see. This means that the first packet that the conntrack module sees, within a specific connection, will be matched. For example, if we see a SYN packet and it is the first packet in a connection that we see, it will match. However, the packet may as well not be a SYN packet and still be considered NEW. This may lead to certain problems in some instances, but it may also be extremely helpful when we need to pick up lost connections from other firewalls, or when a connection has already timed out, but in reality is not closed.		The NEW state tells us that the packet is the first packet that we see. This means that the first packet that the conntrack module sees, within a specific connection, will be matched. For example, if we see a SYN packet and it is the first packet in a connection that we see, it will match. However, the packet may as well not be a SYN packet and still be considered NEW. This may lead to certain problems in some instances, but it may also be extremely helpful when we need to pick up lost connections from other firewalls, or when a connection has already timed out, but in reality is not closed.