iptables

Peter Vrabec pvrabec at redhat.com
Tue Jun 25 15:46:20 UTC 2013


Hi list,

I have seen "iptables and ip6tables" section of rhel6-guide.html 
recently and I have concerns about few recommendation.

example:
"Set Default iptables Policy for Incoming Packets"
----
To set the default policy to DROP (instead of ACCEPT) for the built-in 
INPUT chain which processes incoming packets, add or correct the 
following line in /etc/sysconfig/iptables:

:INPUT DROP [0:0]

In iptables the default policy is applied only after all the applicable 
rules in the table are examined for a match. Setting the default policy 
to DROP implements proper design for a firewall, i.e. any packets which 
are not explicitly permitted should not be accepted.
---


This ^^^ is doable but it won't have any real effect since the last rule 
of a built-in INPUT chain is REJECT. Default DROP policy won't be applied.

5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with 
icmp-host-prohibited


Please note I'm not a firewall expert, I just want to raise awareness. 
Maybe I miss some important fact.


Peter.



More information about the scap-security-guide mailing list