[PATCH 1/3] Correcting the default iptables policy

Kevin Spargur kspargur at redhat.com
Mon Oct 15 03:08:43 UTC 2012


---
 RHEL6/input/system/network/iptables.xml |   28 +++++++++-------------------
 1 files changed, 9 insertions(+), 19 deletions(-)

diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 45fd6de..ae146db 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -33,29 +33,19 @@ the following commands (and analogously for ip6tables):
 <pre># service iptables restart</pre>
 The default iptables rules are:
 <pre>Chain INPUT (policy ACCEPT)
-num target prot opt source destination
-1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0
+num  target     prot opt source       destination
+1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
+2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
+3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
+4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
+5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 
 
 Chain FORWARD (policy ACCEPT)
-num target prot opt source destination
-1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0
+num  target     prot opt source       destination
+1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 
 
 Chain OUTPUT (policy ACCEPT)
-num target prot opt source destination
-
-Chain RH-Firewall-1-INPUT (2 references)
-num target prot opt source destination
-1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
-2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255
-3 ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0
-4 ACCEPT ah -- 0.0.0.0/0 0.0.0.0/0
-5 ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
-6 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:631
-7 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:631
-8 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
-9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
-10 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with
-icmp-host-prohibited</pre>
+num  target     prot opt source       destination</pre>
 The <tt>ip6tables</tt> default rules are similar, with its rules 2 and
 10 reflecting protocol naming and addressing differences. Instead
 of rule 8, however, <tt>ip6tables</tt> includes two rules that accept all
-- 
1.7.7.6



More information about the scap-security-guide mailing list