Home / ubuntu / Questions / 932529
Accepted
lewis4u
Asked: 2017-07-07 00:56:24 +0800 CST

What is the difference between these 2 iptable rules?

  • 772

I am learning about iptables and can't find an explanation about the difference between these 2 rules:

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

sudo iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

What does the state "NEW" mean? If there is a state "NEW" is there a state "OLD" then?

iptables

1 Answers

  1. Best Answer

    NEW is the state when the connection is first made. It is common to ACCEPT all ESTABLISHED,RELATED connections early in the iptables rules to reduce the processing load. Subsequent rules determine what NEW connections are allowed based on port number, etc. For the two rules above, the first will allow all traffic in on port 80, while the second will only allow the initial handshake. If the default rule was to DROP packets the second rule alone would be insufficient to allow communications on port 80.

    • 3