The iptables-extensions manpage has this to say about the conntrack extension (emphasis mine):

This module, when combined with connection tracking, allows access to the connection tracking state for this packet/connection.

I thought conntrack is connection tracking?

Why does the manpage say "combined with connection tracking"?

If conntrack is not connection tracking, then what is it?

What would be the "other" connection tracking? Where would that come from?


Connection tracking is already recording things about the tracked connections, like whether one connection is related to another (such as a new FTP DATA connection being related to an existing FTP session, even though it's on a different port.)

The conntrack iptables extension provides additional criteria you can use in iptables rules to match the tracked state, for instance by allowing these related connections through.

If you don't use the conntrack extension then the connections are still tracked by the kernel (if the appropriate kernel modules are loaded) but that tracking information then goes unused as it won't be examined by any iptables rules.

Basically the whole connection tracking system is split in two - the bit in the kernel that does the actual tracking, and the bit in iptables that examines the tracking information from the kernel and decides whether to allow a given packet through or not.

This is a bit of a simplification but hopefully explains it in general terms.

  • "appropriate kernel modules" as in nf_conntrack*? – Kal Apr 26 '15 at 5:02
  • 1
    Yes. You probably only need nf_conntrack, and xt_conntrack, plus zero or more of the nf_conntrack_* modules depending on which protocols you need to track. – Malvineous Apr 26 '15 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.