On 06/11/2010 10:53 AM, Daniel P. Berrange wrote: Ok, I'll invert the logic. Background: I can specify rules so that the ssh port 22 (tcp) is reachable on my system and no other traffic is possible. If I don't use the --match target on this tcp port 22 rule, I could initiate traffic inside the VM from TCP port 22 (client port) towards an allowed target. If the --match NEW, ESTABLISHED target is added on incoming traffic, I get control over directionality due to the NEW. The outgoing direction will then have --match ESTABLISHED. Since the NEW will be missing on outgoing traffic, I won't be able to initiate that traffic. In essence it's iptables -p tcp --dport 22 -j ACCEPT versus iptables -p tcp --dport 22 -m state --state NEW, ESTABLISHED