I recall seeing an example rule where the person allowed all established connections; it went something like this:
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Is this a safe generic rule to have? Or is it better for me to state every case explicitly?
Joe Tseng wrote:
I recall seeing an example rule where the person allowed all established connections; it went something like this:
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Is this a safe generic rule to have? Or is it better for me to state every case explicitly?
That allows traffic with any established connexion to pass. Any traffic not associated with an existing traffic will not be permitted by that rule, so it does not permit any new sessions to start.
For that to occur, you need rules to explicitly allow connexions to specific services ahead of any rule (including policy) that denies them.
It clarify, here are some lines from my /etc/sysconfig/iptables -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
The first allows existing sessions to continue. Then I explicitly allow connexions to three services. Finally, I deny all not explicitly allowed. On a firewall, I'd likely DROP rather than REJECT as the former causes unwelcome visitors to wait for a timeout.
Joe Tseng wrote:
I recall seeing an example rule where the person allowed all established connections; it went something like this:
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Is this a safe generic rule to have? Or is it better for me to state every case explicitly?
Good, safe, and should be first. Rules are processed in order, so you reduce the overhead by putting the most likely case first, in this case ESTABLISHED.