Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > comp.os.linux.misc > #11764

Re: Comment on iptables for a home computer?

From Rich <rich@example.invalid>
Newsgroups comp.os.linux.misc
Subject Re: Comment on iptables for a home computer?
Date 2014-08-19 21:16 +0000
Organization My Linux Box
Message-ID <lt0es0$3m4$2@dont-email.me> (permalink)
References <f71a0f23-7e9c-45bd-98a6-cf0daeccf9ec@googlegroups.com>

Show all headers | View raw


nomdeplume82008@googlemail.com wrote:
> What do you think of this iptables ruleset?

>   Chain INPUT (policy DROP)
>   target     prot opt source               destination         
> 1 ACCEPT     all  --  anywhere             anywhere            
> 2 ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

>   Chain FORWARD (policy DROP)
>   target     prot opt source               destination         

>   Chain OUTPUT (policy DROP)
>   target     prot opt source               destination         
> 3 ACCEPT     all  --  anywhere             anywhere            
> 4 ACCEPT     all  --  anywhere             anywhere             state NEW,RELATED,ESTABLISHED

Line numbers added above for clarity.  You should have dumped with the
"--line-numbers" switch to begin with.

Line 1 undoes everything a default DROP on INPUT performs.  Because
line 1 accepts anything, from anywhere.

Line 2 is never executed, because anything, from anywhere, for any
reason, is already accepted by line 1.

Line 3 & 4 are identical to lines 1 & 2 as far as what they do, and
what they allow.

This ruleset is identical to having no firewall at all.  Anything, from
anywhere, in any state, is accepted.

If your plan is to expose all ports to the network interface, it is
perfect.

If your plan is to actually "firewall" the machine, it won't work.


You could achieve the identical "ruleset" by doing this:

iptables --flush
iptables --policy INPUT ACCEPT
iptables --policy OUTPUT ACCEPT

Back to comp.os.linux.misc | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-19 10:20 -0700
  Re: Comment on iptables for a home computer? Andreas Kohlbach <aug14.8.ankman@spamgourmet.com> - 2014-08-19 16:41 -0400
  Re: Comment on iptables for a home computer? Rich <rich@example.invalid> - 2014-08-19 21:16 +0000
  Re: Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-20 08:53 -0700
    Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-21 22:47 +0200
      Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-21 23:37 +0100
        Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-22 10:45 +0200
          Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-22 10:41 +0100
            Re: Comment on iptables for a home computer? Marc Haber <mh+usenetspam1118@zugschl.us> - 2014-08-22 12:00 +0200

csiph-web