On Thursday 20 May 2004 4:06 pm, Aleksandar Milivojevic wrote:
Are ICMP packets related to new and established TCP connections and UDP traffic considered to be part of them,
An ICMP packet which is returned in response to a previously sent TCP or UDP packet is considered to be RELATED.
Thanks. This preaty much answers my question.
or do I need to have explicit rules like
-A INPUT -p icmp -m state --state RELATED -j ACCEPT
for things like path MTU discovery, traceroute, ICMP port unreachables, and so on to work properly?
Nothing wrong with the above rule, however remember that it isn't only ICMP packets which are considered to be RELATED - in an FTP connection, for example, the reverse (data) connection is considered to be RELATED to the original (control) connection, even though it's another TCP link, not ICMP.
Yup, I'm aware of that part.
Any downsides of using generic rule like above (if it is needed)?
Most people use an even *more* generic rule:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Actually, the orginal question was prompted because I'm avoiding this more generic rule :-)
-- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
