Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.misc > #11764
| From | Rich <rich@example.invalid> |
|---|---|
| Newsgroups | comp.os.linux.misc |
| Subject | Re: Comment on iptables for a home computer? |
| Date | 2014-08-19 21:16 +0000 |
| Organization | My Linux Box |
| Message-ID | <lt0es0$3m4$2@dont-email.me> (permalink) |
| References | <f71a0f23-7e9c-45bd-98a6-cf0daeccf9ec@googlegroups.com> |
nomdeplume82008@googlemail.com wrote: > What do you think of this iptables ruleset? > Chain INPUT (policy DROP) > target prot opt source destination > 1 ACCEPT all -- anywhere anywhere > 2 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED > Chain FORWARD (policy DROP) > target prot opt source destination > Chain OUTPUT (policy DROP) > target prot opt source destination > 3 ACCEPT all -- anywhere anywhere > 4 ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED Line numbers added above for clarity. You should have dumped with the "--line-numbers" switch to begin with. Line 1 undoes everything a default DROP on INPUT performs. Because line 1 accepts anything, from anywhere. Line 2 is never executed, because anything, from anywhere, for any reason, is already accepted by line 1. Line 3 & 4 are identical to lines 1 & 2 as far as what they do, and what they allow. This ruleset is identical to having no firewall at all. Anything, from anywhere, in any state, is accepted. If your plan is to expose all ports to the network interface, it is perfect. If your plan is to actually "firewall" the machine, it won't work. You could achieve the identical "ruleset" by doing this: iptables --flush iptables --policy INPUT ACCEPT iptables --policy OUTPUT ACCEPT
Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-19 10:20 -0700
Re: Comment on iptables for a home computer? Andreas Kohlbach <aug14.8.ankman@spamgourmet.com> - 2014-08-19 16:41 -0400
Re: Comment on iptables for a home computer? Rich <rich@example.invalid> - 2014-08-19 21:16 +0000
Re: Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-20 08:53 -0700
Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-21 22:47 +0200
Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-21 23:37 +0100
Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-22 10:45 +0200
Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-22 10:41 +0100
Re: Comment on iptables for a home computer? Marc Haber <mh+usenetspam1118@zugschl.us> - 2014-08-22 12:00 +0200
csiph-web