There is this question on ServerFault from the year 2012:
What's the practical difference between:
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Which one is best to use?
The accepted answer is:
Both use same kernel internals underneath (connection tracking
xt_conntrack - Netfilter module to match connection tracking
information. (Superset of Rusty's minimalistic state match.)
So I would say -- state module is simpler (and maybe less error
prone). It's also longer in kernel. Conntrack on the other side has
more options and features.
My call is to use
conntrack if you need it's features, otherwise stick
with state module.
Similar question on netfilter
 Quite useful like
-m conntrack --ctstate DNAT -j MASQUERADE"
routing/DNAT fixup ;-)
One of the other answers leads to this document about
iptables. It says:
conntrack match is an extended version of the
state match, which makes it possible to match packets in a much more granular way. It let's you look at information directly available in the connection tracking system, without any "frontend" systems, such as in the
So I think this is true (from yet another answer there):
There is no difference in the outcome of those two rules.
Note there is also an interesting comment under the question:
state is deprecated in favor of
conntrack, and may or may not be compiled in depending on how your kernel was built.