IPSec: Does it make sense to use conntrack state on ESP in an iptable rule? [closed]

Question

Does it make sense to have an iptable rule as below?

-A INPUT -p esp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

I could not find any documentation that would explain the meaning of "states" on an ESP flow. TCP/UDP/ICMP are explained in this link (http://www.iptables.info/en/connection-state.html).

Since ESP does not have the concept of port or connection, is it meaningful to have a rule as above? How will conntrack determine the state of a flow here? If it actually means something, could someone kindly explain and point out the documentation?

Answer 1

A lot like it would for UDP, basically: it checks if a flow has been seen previously.

In passing, I don't think you need to have RELATED in there (that's more for things like FTP, where you have more than one flow involved in a connection).

In general, you would have ESP in tunnel mode, where the only states are pretty much 'there', or 'not there'. NEW would simply mean (I think) you allow remote hosts to initiate the connection.

You would therefore need the rule if remote hosts did need to connect, and the rule could be made to justify its presence by limiting ESP flows to known hosts only (i.e. use a -s MYNETWORK, or an ipset, to limit who can speak ESP to whom).

You possibly don't need stateful, though.