In this lesson, you will learn how to use connection tracking helpers to manage stateful inspection for protocols that use multiple ports or embed IP/port information within their data payloads.
The Problem with Stateful Inspection
Standard connection tracking (conntrack) is excellent at tracking simple, static sessions like HTTP or SSH, where the source and destination ports remain constant throughout the conversation. However, complex legacy protocols—most notably FTP and SIP—break this model.
In an FTP "Active" session, the client connects to the server’s control port (21), but then tells the server to initiate a separate data connection back to a random port on the client. Because the server is initiating a new connection from a port unrelated to the control session, a standard firewall would see this as an unauthorized, unsolicited connection attempt and drop it.
How Helpers Bridge the Gap
Connection tracking helpers act as "application-aware" interceptors. When a packet passes through the Netfilter hooks, the helper inspects the packet's payload (the Layer 7 data). If it detects an FTP PORT command or a SIP INVITE message, it parses the payload to identify the dynamic port numbers being negotiated.
The helper then creates an "Expectation" in the kernel. This is essentially a temporary hole in the firewall, telling the conntrack engine: "Expect an incoming connection from the server to this specific client port within the next few seconds."
Implementation Example
In modern nftables, you load these helpers to permit the traffic without opening wide port ranges:
# Load the FTP helper module
table ip filter {
chain output {
type filter hook output priority 0;
ct helper set "ftp-standard"
}
}
By assigning the helper to the flow, the kernel automatically tracks the secondary connections associated with the primary control session. Without this, your firewall would force you to open massive ranges of ports (the passive port range), which significantly degrades your security posture.
Helpers allow your firewall to remain "tight" by only opening the specific dynamic ports the application actually requires, for only as long as the application needs them.
Key Takeaway: Connection tracking helpers allow the kernel to inspect protocol payloads and dynamically permit secondary connections, enabling secure stateful inspection for multi-port protocols like FTP and SIP.