[PATCH 1/3] Correcting the default iptables policy
Kevin Spargur
kspargur at redhat.com
Mon Oct 15 03:08:43 UTC 2012
---
RHEL6/input/system/network/iptables.xml | 28 +++++++++-------------------
1 files changed, 9 insertions(+), 19 deletions(-)
diff --git a/RHEL6/input/system/network/iptables.xml b/RHEL6/input/system/network/iptables.xml
index 45fd6de..ae146db 100644
--- a/RHEL6/input/system/network/iptables.xml
+++ b/RHEL6/input/system/network/iptables.xml
@@ -33,29 +33,19 @@ the following commands (and analogously for ip6tables):
<pre># service iptables restart</pre>
The default iptables rules are:
<pre>Chain INPUT (policy ACCEPT)
-num target prot opt source destination
-1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0
+num target prot opt source destination
+1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
+2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
+3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
+5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
-num target prot opt source destination
-1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0
+num target prot opt source destination
+1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
-num target prot opt source destination
-
-Chain RH-Firewall-1-INPUT (2 references)
-num target prot opt source destination
-1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
-2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255
-3 ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0
-4 ACCEPT ah -- 0.0.0.0/0 0.0.0.0/0
-5 ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
-6 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:631
-7 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:631
-8 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
-9 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
-10 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with
-icmp-host-prohibited</pre>
+num target prot opt source destination</pre>
The <tt>ip6tables</tt> default rules are similar, with its rules 2 and
10 reflecting protocol naming and addressing differences. Instead
of rule 8, however, <tt>ip6tables</tt> includes two rules that accept all
--
1.7.7.6
More information about the scap-security-guide
mailing list