My default policy for all chains is drop. I'm trying to understand if there is a difference between the order of ESTABLISHED,RELATED and RELATED,ESTABLISHED when conntrack is entered into a rule command.

For are these two command the same?

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

There is no difference depending on the order. It is just a list of one ore more states that you want to match.

If you want separate packet/byte counters, you can create two rules, one with ESTABLISHED and one with RELATED.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.