mokkan
asked on
IP tables question
Hello,
I undestad that we are allowing port s 7000 - 7050
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7050 -j ACCEPT
Do you why we have "-m state --state NEW " this option?
I undestad that we are allowing port s 7000 - 7050
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7050 -j ACCEPT
Do you why we have "-m state --state NEW " this option?
ASKER
Thank you very much. In this case what is the difference beween these 2 commands. Both are doing same thing. Second command check the connection state, before accept. Am I right?
iptables -A INPUT -p tcp --dport 7000:7050 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7050 -j ACCEPT
iptables -A INPUT -p tcp --dport 7000:7050 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7050 -j ACCEPT
The difference is that you are limiting the command to new connections in the first command. Other than that I believe that they both perform the same function.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks a lot.
No problem
-m state is used to set up the matching criteria (in this case the state) and then the --state NEW is used to set the criteria to new connections only. Established connections should not be affected by this command.