I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this?

Take the following two rule sets (iptables):

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate NEW,INVALID -j REJECT


iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j REJECT

Functionally, I can't see any difference. But maybe that's just my inexperience talking, is there really a benefit of one over the other?

  • As the question was more about how the examples given compared functionally rather than how robust it would be to implement each approach, I added in the INVALID match as Darius correctly pointed out was missing. – AlexH Jun 25 '13 at 16:14

Using state-based filtering across the board in an effort to make troubleshooting a firewall ruleset easier will not work out as intended. The result is likely to be quite the opposite.

State is just another characteristic to filter packets on. There is not reason that each rule in a ruleset should use the same characteristics. Or that "stateful" is somehow an inherently superior approach.

For a ruleset easier to be set up accurately, easy to troubleshoot and easy to update without breaking things it needs to be comprehensible to the administrator. It will be easier to understand if the rules are expressed as simply as possible. So additional filtering characteristics - particularly those such as state which are harder to follow in your head - should be used only when necessary.

  • Well said, i guess there is a definite point where the usability of a security tool and the functionality of that tool are the one and the same thing. – AlexH Jun 27 '13 at 8:21

There's no problem with the latter ruleset, I would personally prefer it. The reason why is, well, to make a case in point: I hope you don't have a default ACCEPT policy, because those --ctstate INVALID packets are going to sneak through. :-)

If you're trying to iterate out every single thing that you want to reject/drop, you're bound to miss something.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.