iptables
Peter Vrabec
pvrabec at redhat.com
Tue Jun 25 15:46:20 UTC 2013
Hi list,
I have seen "iptables and ip6tables" section of rhel6-guide.html
recently and I have concerns about few recommendation.
example:
"Set Default iptables Policy for Incoming Packets"
----
To set the default policy to DROP (instead of ACCEPT) for the built-in
INPUT chain which processes incoming packets, add or correct the
following line in /etc/sysconfig/iptables:
:INPUT DROP [0:0]
In iptables the default policy is applied only after all the applicable
rules in the table are examined for a match. Setting the default policy
to DROP implements proper design for a firewall, i.e. any packets which
are not explicitly permitted should not be accepted.
---
This ^^^ is doable but it won't have any real effect since the last rule
of a built-in INPUT chain is REJECT. Default DROP policy won't be applied.
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with
icmp-host-prohibited
Please note I'm not a firewall expert, I just want to raise awareness.
Maybe I miss some important fact.
Peter.
More information about the scap-security-guide
mailing list