iptables chain modification

gizza23 · 07-09-2005, 09:07 PM

There's this persistent part of my INPUT chain that will not go away.

Code:

ACCEPT     all  --  anywhere             anywhere

Does anyone have any clue how to get rid of such a general rule?

Sharaz · 07-09-2005, 09:52 PM

is that the only rule in there? take a look at the file /etc/sysconfig/iptables. i think you can just omit the offending line. or, if you have no other rules, you can just:

iptables -F
or
iprables -F INPUT

and wipe them so you can start over.

me personally, i write my own firewall scripts for my boxes, and they all begin with:

Code:

#!/bin/bash
iptables --flush
# Set Default Policy for INPUT Chain
iptables -P INPUT DROP
# Allow Related and Established Traffic
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow from Localhost, and ICMP from local LAN
iptables -A INPUT -p icmp -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT

gizza23 · 07-10-2005, 05:45 AM

Thanks for the help! I did end up deleting that particular line from the INPUT chain (it was the third). There is one thing that I found interesting about your iptables shell. It allows pings from within your network. I'll want to use that later on. So thanks + 1!