LinuxQuestions.org - [SOLVED] iptables: drop rule

- Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)

- - iptables: drop rule (https://www.linuxquestions.org/questions/linux-newbie-8/iptables-drop-rule-803163/)

iptables: drop rule

hi,

do i have to create a rule for:

Code:

$IPT -A fwalert -p tcp --tcp-flags SYN,ACK SYN,ACK -m conntrack --ctstate NEW $RLIMIT -j LOG $LOGLIMIT --log-tcp-options --log-level 4 --log-prefix

to drop rather than log if my table has a default policy of drop with :

Code:

$IPT -t fwalert -P DROP

thanks

Quote:

Originally Posted by mrmnemo (Post 3942020)

hi,

do i have to create a rule for:

Code:

$IPT -A fwalert -p tcp --tcp-flags SYN,ACK SYN,ACK -m conntrack --ctstate NEW $RLIMIT -j LOG $LOGLIMIT --log-tcp-options --log-level 4 --log-prefix

to drop rather than log if my table has a default policy of drop with :

Code:

$IPT -t fwalert -P DROP

thanks

I think something is terribly wrong here. In the first command, you're appending a rule to the fwalert chain (which is user-built, and can therefore not have a policy set on it). In the second command, you're trying to set a policy on a table called fwalert, without specifying to which chain in the table you wish the policy to apply. Needless to say, you can't set a policy for a table either (plus there's no table called fwalert), so I'm not even sure what you're trying to accomplish here. If you can shed light on what your intentions are, surely someone here will be able to help you out, though.

THanks For the quick response

Thanks bud.
I have corrected the issue with trying to apply a default POLICY to user defined tables. Thanks for that!

so i guess my question is this. Once a packet gets sent to a table ( fwalert in my case) I can have a rule to drop ALL in the table right?

Code:

$IPT -A fwalert -j DROP

this is after i run some loggin and what not. In my case i am trying to set sections up in a script to make things easy to track. so fwalert, sshdrop, etc ( all which i am defining) will have a default drop if i forget to match something. anyways, would that be correct for my drop?

Quote:

Originally Posted by mrmnemo (Post 3942139)

That's not a table, it's a chain.

Quote:

Code:

$IPT -A fwalert -j DROP

Yes, if you set a rule like that as the last one in a chain, it will be matched by all packets (since it doesn't have any matches specified). In other words, you can certainly achieve the same results you were seeking originally when you wanted to set a policy for user-built chains. Example:

Code:

$IPT -A fwalert -s 192.168.12.156 -j ACCEPT

$IPT -A fwalert -j DROP

Here, any packet traversing the fwalert chain with a source IP other than 192.168.12.156 will get sent to DROP.