Hello and welcome back.
In this lecture, we'll dive into stateful firewall's.
Net filter has a molecule called contract that permits us to inspect and restrict network connections
using a method called connection tracking.
Connection tracking refers to the ability of maintaining state information about the connection in memory
Tabors.
Firewalls that do this are known as stateful and are much more secure than they are stateless or packet
based counterpart.
The decision to drop or to accept al-Bakhit is not taken anymore based on the values in the packet headers
like source or destination IP addresses or ports, but on the relationships it has with other Bishkek's.
For a packet, there are the following states defined a new packet is the first packet of any connection.
In fact, the packet requesting a new connection, such as a Tsipi packet with the SEAL Flex set or
the first ICMP echo request packet.
Back in the established state are those that are already part of an existing connection, all because
of the connection starting with the second packet and until the last one are in the established state,
related packets are those that are requesting a new connection but are already part of an existing connection,
such as FTP data transfer or an ISP error.
In general, it's good practice to accept these packets.
An invalid packet is not part of any connection in the connection tracking table, these packets cannot
be identified in any state.
Generally, it is a good idea to drop everything in this state.
In the last state is called untracked index and not so often used.
Briefly, if a packet is marked within the right table with the no track target, then that packet will
show up is entr'acte in the state machine?
Note that you can use the stateful functionality of IP tables, connection tracking with any network
protocol, even though the protocol itself is stateless, such as UDP or ICMP.
To make Bishkek's based on their state use, minus M state, minus minus state, and then a comma separated
values of Bishkek's states written in uppercase letters.
In this example, we are accepting incoming Bishkek's if they are already part of an existing Conexion.
Another rule or the policy of the input chain could drop the first packet of the connection, which
is in the new state.
This means that the host can connect to any destination using any protocol, but no one is allowed to
connect to services running on the host.
This was just an introduction to stateful fireballs in the next lecture will see a real example of how
to configure a stateful firewall using IP tables.