Firewall functions: IPTABLES
U
SER
G
UIDE
186
An ICMP message is also used to inform the host that a TCP or UDP connection has been
established about reachability of the partner, e.g. unreachable.
For this reason, ICMP replies are accepted as
RELATED
.
In this case the client sends a SYN packet to a specific address; this is classified as a
NEW
connection. However the server is not available, so the router sends an ICMP unreachable message.
Connection tracking recognises the packet as
RELATED
thanks to the entry of the table so the reply
can be addressed to the client. Immediately after, the client destroys the entry of the table.
FTP connections
The FTP protocol firstly opens a single connection, called control session. When a command is
executed across this connection, other ports are opened in order to transmit the remaining data
related to the specific command. These connections can be made either active or passive. When
they are active, the FTP client sends to the server a port and an IP address to connect to. The FTP
client then opens the port, the server connects from a non-privileged port chosen randomly and
data exchange ensues. The firewall does not know these additional connections since they are
negotiated within the payload of exchanged packets. For this reason, the firewall does not know
that it must allow the server to connect to these ports. Extensions to the firewall filters are
therefore necessary so that it is able to collect information among the data exchanged and classify
these additional connections as
RELATED
.
A passive FTP operates in the opposite direction. The FTP client informs the server that it requires
specific data; the server replies with an IP address and port to connect to. The client connects to the
specified port from its port 20 (FTP data port) and acquires the data. In this case too, it is necessary
an additional firewall module which is able to intercept this information in the payload of the packet
and to classify this second connection as
RELATED
.
