[gentoo-user] IPTABLES syntax change?

["Walter Dnes" <waltdnes@waltdnes.org>]

  Many years ago, I understood IPCHAINS, and the first versions of
IPTABLES.  However, IPTABLES has followed the example of Larry Wall's
Practical Extraction and Reporting Language
and turned into a pseudo-OS that I barely comprehend.  Some rules
that I added many years ago were designed to reject unsolicited
connection attempts (after whitelisting my small LAN)...

-A ICMP_IN -p icmp -m state -j UNSOLICITED
-A TCP_IN -p tcp -m state -m tcp -j UNSOLICITED
-A UDP_IN -p udp -m state -j UNSOLICITED

  Now these all give me the error message...

WARNING: The state match is obsolete. Use conntrack instead.
iptables-restore v1.4.16.3: state: option "--state" must be specified

  "man iptables" suggested "man iptables-extensions".  As near as I can
tell, the "new and improved" way is...

-A ICMP_IN -p icmp -m conntrack --ctstate INVALID -j UNSOLICITED
-A TCP_IN -p tcp -m conntrack --ctstate INVALID -m tcp -j UNSOLICITED
-A UDP_IN -p udp -m conntrack --ctstate INVALID -j UNSOLICITED

  This appears to work, i.e. it doesn't cause iptables to fail.  Does
this do what I think it does (reject unsolicited connections)?  The
reason that I'm asking is because I'm simply not sure.

-- 
Walter Dnes <waltdnes@waltdnes.org>
I don't run "desktop environments"; I run useful applications