its unclear to me what connection-state “established” means exactly?
Its very confusing to me, because there is a TCP-Connection State “established” but not everything is TCP…
I can create Firewall-Filter-Rules:
UDP + Connection State = established → Action Passthrough
ICMP + Connection State = established → Action Passthrough
Both rules match to certain packets. Now, this cant be the “TCP-Connection State established” because these are non-TCP-packets.
How can I see which non-TCP-Packets are in the state “established”?
Does the “seen reply” flag in the Conn-Tracking means this is “established” (for TCP AND non-TCP-Traffic)? And does this apply to “related” non-TCP-Traffic as well?
For connection-less IP protocols (i.e. anything but TCP), RouterOS fakes connections and their states. It makes configuring firewall much easier.
For example: UDP connection from A to B [*]. When ROS sees first packet, it creates connection tracking entry with state new. When it sees first packet from B to A [**], it updates “connection” state to established. As there is no tear-apart procedure for termination of such (bogus) connections, ROS relies on timer expiry to transition connection to state “finished” (actually it’s dropped from connection tracking list). This is one of reasons why fast-track only deals with most but not all packets, some packets need to go via slow-path to reset connection tracking timers.
[] Here A means pair src IP address - src port. Likewise B means pair dst IP address - dst port
[**] Here A means pair dst IP address - dst port and likewise B means pair src IP address - src port. If A and B of this line match A and B of preceeding line [], then these are packets of same “connection”, flowing in opposite directions.
connection oriented or connectionless protocols have nothing to do with this, this only comes in between the two end devices.
This is only relevant to firewalls, connection tracking uses both src and dst addresses with the src and dst ports to decide of it is a new connection, established, etc
