Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this?

Take the following two rule sets (iptables):

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate NEW,INVALID -j REJECT

and

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j REJECT

Functionally, I can't see any difference. But maybe that's just my inexperience talking, is there really a benefit of one over the other?

share|improve this question
    
As the question was more about how the examples given compared functionally rather than how robust it would be to implement each approach, I added in the INVALID match as Darius correctly pointed out was missing. –  AlexH Jun 25 '13 at 16:14
add comment

2 Answers

Using state-based filtering across the board in an effort to make troubleshooting a firewall ruleset easier will not work out as intended. The result is likely to be quite the opposite.

State is just another characteristic to filter packets on. There is not reason that each rule in a ruleset should use the same characteristics. Or that "stateful" is somehow an inherently superior approach.

For a ruleset easier to be set up accurately, easy to troubleshoot and easy to update without breaking things it needs to be comprehensible to the administrator. It will be easier to understand if the rules are expressed as simply as possible. So additional filtering characteristics - particularly those such as state which are harder to follow in your head - should be used only when necessary.

share|improve this answer
    
Well said, i guess there is a definite point where the usability of a security tool and the functionality of that tool are the one and the same thing. –  AlexH Jun 27 '13 at 8:21
add comment

There's no problem with the latter ruleset, I would personally prefer it. The reason why is, well, to make a case in point: I hope you don't have a default ACCEPT policy, because those --ctstate INVALID packets are going to sneak through. :-)

If you're trying to iterate out every single thing that you want to reject/drop, you're bound to miss something.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.