Link to home
Start Free TrialLog in
Avatar of mokkan
mokkan

asked on

IP tables question

Hello,

I undestad that we are allowing port s 7000 - 7050


iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7050  -j ACCEPT


Do you why we have  "-m state --state NEW " this option?
Avatar of Steven Carnahan
Steven Carnahan
Flag of United States of America image

-m state --state NEW — The matching packet is either creating a new connection or is part of a two-way connection not previously seen.

-m state is used to set up the matching criteria (in this case the state) and then the --state NEW is used to set the criteria to new connections only. Established connections should not be affected by this command.
Avatar of mokkan
mokkan

ASKER

Thank you very much. In this case what is the difference beween these 2 commands. Both are doing same thing. Second command check the connection state, before accept. Am I right?

iptables -A INPUT  -p tcp --dport 7000:7050  -j ACCEPT


iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7050  -j ACCEPT
The difference is that you are limiting the command to new connections in the first command. Other than that I believe that they both perform the same function.
ASKER CERTIFIED SOLUTION
Avatar of comfortjeanius
comfortjeanius
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of mokkan

ASKER

Thanks a lot.
No problem