Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use iptables and ip6tables to establish basic networking security on my webserver. However, I am having a hard time understanding the RELATED state of the conntrack module... I know that a packet is tracked as NEW when it is trying to establish a new connection, and as ESTABLISHED when it belongs to a previsouly established connection... But I really can't figure out under what situations a packet can be marked as RELATED (being that I know what the "definition" of RELATED means)... Can anyone please help me out with this?

share|improve this question

The RELATED state means that the packet starts a new connection, but that connection is related to an existing connection. The classic example would be an FTP data connection that matches an existing FTP control connection.

This is most commonly used in NAT devices to permit incoming connections to work where existing outgoing connections make it clear which inside device the connection should go to. A classic example where this is needed is "no route to host" ICMP errors. They aren't part of an existing connection because they have a different source IP address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.