Community discussions

MikroTik App
 
paris9
newbie
Topic Author
Posts: 32
Joined: Mon Feb 03, 2014 9:31 am

STATEFULL FIREWALL RULE QUESTION

Sat Jun 30, 2018 11:58 am

Would there ever be a reason to use “connection-state=new” below the line “action=drop connection-state=invalid” ?

For example, if at the top of my forward rules I say:
add chain=forward action=accept connection-state=established,related
add chain=forward action=drop connection-state=invalid

Is it not the case that the only connection state remaining is "new"?
Am I correct is saying that there is no point in using "connection-state=new" from here on?

chain=forward action=accept protocol=tcp dst-address=192.168.1.5 dst-port=80
chain=forward action=accept connection-state=new protocol=tcp dst-address=192.168.1.5 dst-port=80
 
Sob
Forum Guru
Forum Guru
Posts: 9121
Joined: Mon Apr 20, 2009 9:11 pm

Re: STATEFULL FIREWALL RULE QUESTION  [SOLVED]

Sat Jun 30, 2018 1:54 pm

There's also relatively new state "untracked". It's meant for packets you want to get through router without connection tracking. The usual way to deal with them is to accept untracked together with established and related, and it's safe, because packets don't become untracked unless you tell them to be. And then yes, "new" will be all that's left for following rules.
 
paris9
newbie
Topic Author
Posts: 32
Joined: Mon Feb 03, 2014 9:31 am

Re: STATEFULL FIREWALL RULE QUESTION

Sat Jun 30, 2018 10:42 pm

There's also relatively new state "untracked". It's meant for packets you want to get through router without connection tracking. The usual way to deal with them is to accept untracked together with established and related, and it's safe, because packets don't become untracked unless you tell them to be. And then yes, "new" will be all that's left for following rules.
Thank you - this solves my question!

Who is online

Users browsing this forum: No registered users and 26 guests