The RELATED state refers to a connection that is used to facilitate another connection. A common example is an FTP session where control data is passed to one connection and actual file data flows through another one. 

iptables -A INPUT -p tcp -d x.x.x.x --dport 21 -m state --state NEW,ESTABLISH,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -s x.x.x.x --sport 21 -m state --state ESTABLISH,RELATED -j ACCEPT

...
Như vậy thì để giao thức FTP hoạt động bình thường thì đối với server ta chỉ cần mở cổng 21 là được hay phải ACCEPT thêm cổng 20 cho ftp-data?
Code:

iptables -A INPUT -p tcp -d x.x.x.x --dport 21 -m state --state NEW,ESTABLISH,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -s x.x.x.x --sport 21 -m state --state ESTABLISH,RELATED -j ACCEPT

 

Và có giao thức nào cần phải có state RELATED này nữa không?
 

Ngoài ra, theo tớ biết state này còn được sử dụng để thông báo các ICMP error. 

quanta wrote:

Ngoài ra, theo tớ biết state này còn được sử dụng để thông báo các ICMP error. 

Bạn có thể nói rõ hơn được không. Khi nào thì có các gói ICMP này? Kể cả khi DROP các packet ICMP thì nó vẫn có thể sinh ra được nữa không? 

Another hugely important part of ICMP is the fact that it is used to tell the hosts what happened to specific UDP and TCP connections or connection attempts. For this simple reason, ICMP replies will very often be recognized as RELATED to original connections or connection attempts. A simple example would be the ICMP Host unreachable or ICMP Network unreachable. These should always be spawned back to our host if it attempts an unsuccessful connection to some other host, but the network or host in question could be down, and hence the last router trying to reach the site in question will reply with an ICMP message telling us about it. In this case, the ICMP reply is considered as a RELATED packet. The following picture should explain how it would look.
 

In the above example, we send out a SYN packet to a specific address. This is considered as a NEW connection by the firewall. However, the network the packet is trying to reach is unreachable, so a router returns a network unreachable ICMP error to us. The connection tracking code can recognize this packet as RELATED. thanks to the already added tracking entry, so the ICMP reply is correctly sent to the client which will then hopefully abort. Meanwhile, the firewall has destroyed the connection tracking entry since it knows this was an error message.