Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.misc > #11788

Re: Comment on iptables for a home computer?

Show all headers | View raw

The Natural Philosopher a écrit :
> On 21/08/14 21:47, Pascal Hambourg wrote:
>> nomdeplume82008@googlemail.com a écrit :
>>
>>> iptables --flush
>>> iptables --policy INPUT DROP
>>> iptables --policy OUTPUT DROP
>>> iptables --policy FORWARD DROP
>>> iptables --append INPUT -i lo -j ACCEPT
>>> iptables --append OUTPUT -o lo -j ACCEPT
>>> iptables --append INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>>> iptables --append OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>> In short this ruleset allows only outgoing connections.
>>
> Strictly it allows incoming connections that are RELATED to previous 
> outgoing ones as well:

Yes. For instance it includes ICMP error messages and FTP data
connections, related to outgoing existing connections.

> Typically a DNS request over UDP from port X to 
> remote port 53 will 'allow' a connection from remote port 53 back to the 
> originating port X, though it can't be considered established because 
> UDP never gets 'established'.

A DNS reply packet is ESTABLISHED. Netfilter connection tracking keeps
some state for UDP flows, and UDP packets can be ESTABLISHED.

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-19 10:20 -0700
  Re: Comment on iptables for a home computer? Andreas Kohlbach <aug14.8.ankman@spamgourmet.com> - 2014-08-19 16:41 -0400
  Re: Comment on iptables for a home computer? Rich <rich@example.invalid> - 2014-08-19 21:16 +0000
  Re: Comment on iptables for a home computer? nomdeplume82008@googlemail.com - 2014-08-20 08:53 -0700
    Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-21 22:47 +0200
      Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-21 23:37 +0100
        Re: Comment on iptables for a home computer? Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-08-22 10:45 +0200
          Re: Comment on iptables for a home computer? The Natural Philosopher <tnp@invalid.invalid> - 2014-08-22 10:41 +0100
            Re: Comment on iptables for a home computer? Marc Haber <mh+usenetspam1118@zugschl.us> - 2014-08-22 12:00 +0200

csiph-web