title: The "definition" of iptables NEW STATE
body: <p>The test environment is:</p>
  
  <p>2 Operating Systems ubuntu server 10.04 installed on VirtualBox</p>
  
  <p>iptables v1.4.4</p>
  
  <p>ip_conntrack module loaded</p>
  
  <p>these are my test rules:</p>
  
  <pre><code>    $IPTABLES -A INPUT -p TCP -m state --state NEW -j LOG --log-prefix "[-IPT-]NEW:"
      $IPTABLES -A INPUT -p TCP -m state --state ESTABLISHED -j LOG --log-prefix "[-IPT-]ESTABLISHED:"
      $IPTABLES -A INPUT -p TCP -m state --state RELATED -j LOG --log-prefix "[-IPT-]RELATED:"
      $IPTABLES -A INPUT -p TCP -m state --state INVALID -j LOG --log-prefix "[-IPT-]INVALID:"
  </code></pre>
  
  <p>using </p>
  
  <pre><code>hping3 -c 1 192.168.0.1 -p 80 [flags combination]
  </code></pre>
  
  <p>I get:</p>
  
  <pre><code>no flag     INVALID
  syn         NEW
  ack         NEW
  rst         INVALID
  fin         INVALID
  syn ack INVALID
  syn rst INVALID
  syn fin INVALID
  ack rst INVALID
  ack fin INVALID
  rst fin INVALID
  syn ack rst INVALID
  syn rst fin INVALID
  ack rst fin INVALID
  syn ack rst fin INVALID
  </code></pre>
  
  <p>I've read more tutorials that say the first packet seen by netfilter has to be NEW(in the user land). I don't understand if there is something in my computer that doesn't work. </p>
  
  <p>Then, on the internet, there are a lot of rules that filter considering both connection state and tcp flags. Are all these wrong? The reason is quite simple: if they are dropping packets that matches new and ! --syn, the result is painful...a lot of packets pass through the "firewall"(if it can be named so)</p>
  
  <p>Is it possible that newer versions of iptables have a different behavior? </p>
  
  <p>please, can you confirm me if you are getting the same result on yours computers? 
  thx, I'll appreciate!</p>