weird iptables

sang_froid · 10-14-2009, 10:59 AM

Hi,

I have a machine which is running Fedora and when I run the command, it outputs as below:

Quote:

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:nrpe
ACCEPT tcp -- 202.52.245.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh
reject-with icmp-port-
unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

However, when I telnet to port 25 of this machine from other machines from other network, it still is allowing to do SMTP... Something is going on strange...what could be going on wrong ?

Any ideas ??

wfh · 10-14-2009, 11:07 AM

Quote:

Originally Posted by sang_froid

Hi,
telnet to port 25 of this machine from other machines from other network, it still is allowing to do SMTP... Something is going on strange...what could be going on wrong ?

Try changing your default to DENY or REJECT. Normally you want to toss out unexpected connections from outside your firewall. The problem with a default policy of ALLOW...any error or omission in your ruleset and packets will get through.

jstephens84 · 10-14-2009, 02:58 PM

Quote:

Originally Posted by sang_froid

Hi,

I have a machine which is running Fedora and when I run the command, it outputs as below:

However, when I telnet to port 25 of this machine from other machines from other network, it still is allowing to do SMTP... Something is going on strange...what could be going on wrong ?

Any ideas ??

As mentioned if you look at your chains default setting, you have to accept everything. Which case you are saying that I am only blocking chains that I add. This type of security is hard to keep up with.

It is better to say I deny everything but These items. So as mentioned, you will want to change your table from accept to deny. This can be done by

Code:

iptables -t FILTER -P INPUT REJECT

you may need to change reject to DROP