Firewalld way how to change default policy type from ACCEPT to something else for a particular chain

Jiri Popelka jpopelka at redhat.com
Mon Oct 13 15:41:26 UTC 2014


On 10/13/2014 05:03 PM, Thomas Woerner wrote:
> On 10/13/2014 03:47 PM, Jiri Popelka wrote:
>> Either hard-wire policy of filter/INPUT to "DROP" - this shouldn't
>> change anything as all 'remaining' packets are matched with
>> -A INPUT -j REJECT --reject-with icmp-host-prohibited
>> anyway.
>>
>> Or add a "policy" support to 'direct' interface. Something like
>> $ firewall-cmd [--permanent] --direct --add-policy { ipv4 | ipv6 | eb }
>> table chain target
>> which would run 'iptables -P -t table chain target'

> I think it would be good to have one global setting in the firewalld
> config file to define the default policy for all default chains in all
> tables.

Setting policies of all chains of all tables to DROP is IMHO *too* 
restrictive. That would AFAICT drop *all* traffic (for example in raw or 
mangle table) and it's not what the 'security guide' suggests - it 
suggests to set DROP policy of filter/INPUT only.

Anyway I think using firewalld's 'drop' zone is what we want here, as I 
already suggested in another answer.

--
Jiri



More information about the firewalld-users mailing list