conntrack iptables CentOS

Введение

conntrack был создан Марком Боучером (Marc Boucher <marc+nf@mbsi.ca>) в качетсве match module для iptables целью заменть устаревший state match и позволить делать match с большим количеством опций

Пример

For example, if you want to allow all the RELATED connections for TCP protocols only, then you can proceed as follows :

iptables -A FORWARD -m conntrack --ctstate RELATED --ctproto tcp -j ACCEPT
iptables --list

Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED

Опции

Поддерживаемые опции для conntrack match :

[!] --ctstate [INVALID|ESTABLISHED|NEW|RELATED|SNAT|DNAT][,...] -> State(s) to match. The "new" `SNAT' and `DNAT' states are virtual ones, matching if the original source address differs from the reply destination, or if the original destination differs from the reply source.

[!] --ctproto proto -> Protocol to match; by number or name, eg. `tcp'.

--ctorigsrc [!] address[/mask] -> Original source specification.

--ctorigdst [!] address[/mask] -> Original destination specification.

--ctreplsrc [!] address[/mask] -> Reply source specification.

--ctrepldst [!] address[/mask] -> Reply destination specification.

[!] --ctstatus [NONE|EXPECTED|SEEN_REPLY|ASSURED][,...] -> Status(es) to match.

[!] --ctexpire time[:time] -> Match remaining lifetime in seconds against value or range of values (inclusive).

источник