Hi,

I was thinking about what rules to use for an iptables firewall for the usual linux desktop .
I think this is perfect but then again i'm not an experienced security expert so i am asking your opinion.

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED -j ACCEPT

As long as you aren't running any sort of services on your desktop, I think your configuration (though maybe extreme) would work just fine.

I would add the RELATED option match to both the INPUT and OUTPUT to widen the criteria a bit more and not hassle the type of connections when there is a need to spontaneously create other connection to increase, for example download speed.

Other than that, it seems fine.

Btw, I'm no security expert, or iptables expert for that matter, so take everything I say with a grain of salt.

Good luck!

As already stated by SonJelfn, you should have a match for packets of state RELATED. I would just add that you are missing a rule for the loopback interface too. Also, IMHO making OUTPUT rules on a desktop doesn't really make much sense unless you really want to lock things down. If you are going to have such a permissive configuration (you're allowing all outgoing connections) I'd say might as well just set the policy to ACCEPT and be done with it (I do this on my laptop). Like:

Hi

Thank you for your help. I was thinking about RELATED also but i was not very sure weather to put it or not...umm but reagarding loopback i didn't think about it so thanks again

If you have more than one pc you should think about the FORWARD list!