iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Accept packets from existing connections
The conntrack match (connection tracking) lets replies to your outgoing traffic come back in while still blocking new inbound connections. ESTABLISHED covers ongoing sessions and RELATED covers helpers like FTP data. This rule is the foundation of a stateful firewall and should be among the first in INPUT.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.