[SOLVED] iptables: drop rule

mrmnemo · 04-20-2010, 08:38 PM

hi,

do i have to create a rule for:

Code:

$IPT -A fwalert -p tcp --tcp-flags SYN,ACK SYN,ACK -m conntrack --ctstate NEW $RLIMIT -j LOG $LOGLIMIT --log-tcp-options --log-level 4 --log-prefix

to drop rather than log if my table has a default policy of drop with :

Code:

$IPT -t fwalert -P DROP

thanks

win32sux · 04-20-2010, 10:52 PM

Quote:

Originally Posted by mrmnemo

hi,

do i have to create a rule for:

Code:

$IPT -A fwalert -p tcp --tcp-flags SYN,ACK SYN,ACK -m conntrack --ctstate NEW $RLIMIT -j LOG $LOGLIMIT --log-tcp-options --log-level 4 --log-prefix

to drop rather than log if my table has a default policy of drop with :

Code:

$IPT -t fwalert -P DROP

thanks

I think something is terribly wrong here. In the first command, you're appending a rule to the fwalert chain (which is user-built, and can therefore not have a policy set on it). In the second command, you're trying to set a policy on a table called fwalert, without specifying to which chain in the table you wish the policy to apply. Needless to say, you can't set a policy for a table either (plus there's no table called fwalert), so I'm not even sure what you're trying to accomplish here. If you can shed light on what your intentions are, surely someone here will be able to help you out, though.

mrmnemo · 04-21-2010, 12:00 AM

Thanks bud.
I have corrected the issue with trying to apply a default POLICY to user defined tables. Thanks for that!

so i guess my question is this. Once a packet gets sent to a table ( fwalert in my case) I can have a rule to drop ALL in the table right?

Code:

$IPT -A fwalert -j DROP

this is after i run some loggin and what not. In my case i am trying to set sections up in a script to make things easy to track. so fwalert, sshdrop, etc ( all which i am defining) will have a default drop if i forget to match something. anyways, would that be correct for my drop?

win32sux · 04-21-2010, 12:14 AM

Quote:

Originally Posted by mrmnemo

Thanks bud.
I have corrected the issue with trying to apply a default POLICY to user defined tables. Thanks for that!

so i guess my question is this. Once a packet gets sent to a table ( fwalert in my case) I can have a rule to drop ALL in the table right?

That's not a table, it's a chain.

Quote:

Code:

$IPT -A fwalert -j DROP

this is after i run some loggin and what not. In my case i am trying to set sections up in a script to make things easy to track. so fwalert, sshdrop, etc ( all which i am defining) will have a default drop if i forget to match something. anyways, would that be correct for my drop?

Yes, if you set a rule like that as the last one in a chain, it will be matched by all packets (since it doesn't have any matches specified). In other words, you can certainly achieve the same results you were seeking originally when you wanted to set a policy for user-built chains. Example:

Code:

$IPT -A fwalert -s 192.168.12.156 -j ACCEPT
$IPT -A fwalert -j DROP

Here, any packet traversing the fwalert chain with a source IP other than 192.168.12.156 will get sent to DROP.