Understanding connection tracking in iptables

view full story

http://serverfault.com – I'm after some clarification of the state/connection tracking in iptables. What is the difference between these rules? iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT If the above are equivalent, do you need to use the conntrack version when using conntrackd? Is connection tracking turned on when a packet is first matched containing -m state --state BLA , or is connection tracking always on? Can/Should connection tracking be used for fast matching like below? If not used like below, would it not me (HowTos)