I believe this can be classified under the "defense in depth" category. You are
correct in saying that in theory nothing should ever be denied from this setting.
However, the security rule of thumb is that all things should be denied unless they are
explicitly allowed and that can be handled multiple ways.
I have seen cases where a table is flushed (intentionally and accidentally) and the
default DENY in that chain is what keeps the system in a secure state. This actually has
a two-fold effect:
1) Without that default deny the system would be open to all traffic.
2) This will put the system into a state where no traffic will be accepted and you can
guarantee this will be noticed quickly. Then you can step in and fix the "real"
problem (why were the rules flushed).
There can be an argument that verifying the last "deny all" rule is an issue of
configuration management, but in the end a proactive approach is better than a reactive
Just my opinion...
[mailto:email@example.com] On Behalf Of Peter Vrabec
Sent: Tuesday, June 25, 2013 11:46 AM
I have seen "iptables and ip6tables" section of rhel6-guide.html
recently and I have concerns about few recommendation.
"Set Default iptables Policy for Incoming Packets"
To set the default policy to DROP (instead of ACCEPT) for the built-in
INPUT chain which processes incoming packets, add or correct the
following line in /etc/sysconfig/iptables:
:INPUT DROP [0:0]
In iptables the default policy is applied only after all the applicable
rules in the table are examined for a match. Setting the default policy
to DROP implements proper design for a firewall, i.e. any packets which
are not explicitly permitted should not be accepted.
This ^^^ is doable but it won't have any real effect since the last rule
of a built-in INPUT chain is REJECT. Default DROP policy won't be applied.
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with
Please note I'm not a firewall expert, I just want to raise awareness.
Maybe I miss some important fact.
scap-security-guide mailing list