iptables question

stny · 03-02-2006, 01:20 AM

When i using "iptables -L -n" to show the iptables rules.
i see following details:

Quote:

[people@localhost ~]$ iptables -L -n
Chain FORWARD (policy DROP)
target prot opt source destination

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 192.168.0.100 0.0.0.0/0 tcp dpt:139
ACCEPT tcp -- 192.168.0.100 0.0.0.0/0 tcp dpt:138
ACCEPT tcp -- 192.168.0.100 0.0.0.0/0 tcp dpt:137
ACCEPT tcp -- 192.168.0.100 0.0.0.0/0 tcp dpt:136

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

Why the OUTPUT and INPUT first rule is
"ACCEPT all -- 0.0.0.0/0 0.0.0.0/0" ?

If the first rule accept all input, this firewall setting is right or wrong?

nguyennh · 03-02-2006, 02:24 AM

Quote:

Why the OUTPUT and INPUT first rule is
"ACCEPT all -- 0.0.0.0/0 0.0.0.0/0" ?

It means that your system accepts all by default.

Quote:

If the first rule accept all input, this firewall setting is right or wrong?

Not right and not wrong . In this case , your "firewall" just seems to be not available . But you can modify it then .

stny · 03-02-2006, 08:19 PM

Quote:

Originally Posted by nguyennh

It means that your system accepts all by default.

Not right and not wrong . In this case , your "firewall" just seems to be not available . But you can modify it then .

How can i modify it ?
because i haven't seen this appcets rule on iptables setting file

gilead · 03-02-2006, 08:36 PM

Can you post your script that creates the rules? Your INPUT chain's default policy is set to DROP, but the first rule (ACCEPT all -- 0.0.0.0/0 0.0.0.0/0) looks like it accepts anything.

There are 2 main ways to modify your rules. You can have a shell script with multiple iptables rules or you can use iptables-save and iptables-restore to store/retrieve them. How to change your rules depends on which method your script is using.

stny · 03-02-2006, 09:39 PM

Quote:

Originally Posted by gilead

Can you post your script that creates the rules? Your INPUT chain's default policy is set to DROP, but the first rule (ACCEPT all -- 0.0.0.0/0 0.0.0.0/0) looks like it accepts anything.

There are 2 main ways to modify your rules. You can have a shell script with multiple iptables rules or you can use iptables-save and iptables-restore to store/retrieve them. How to change your rules depends on which method your script is using.

I have try to remove the 139, 138, 137 ports input rules.
After restart the iptables, i can't use the samba to connect to the linux.

But when i reinput these rules and restart the iptables again. the samba work fine. The result and the rule output list not same

Here is the iptable script.

Quote:

## /etc/sysconfig/iptables

## Default policy - deny all request
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
#:OUTPUT DROP [0:0]

## Pass all locally-originating packets
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

## Accept only ICMP ping echo request
#-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

## Accept all ICMP requests
-A INPUT -p icmp -j ACCEPT

## Accept traffic on port from a specific IP
## (Do NOT remove the following keywords,
## as they're needed to alter incoming IPs and ports.)
## UPDATE ##
-A INPUT -p tcp -m tcp -s 192.168.0.100 --dport 139 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.0.100 --dport 138 -j ACCEPT
-A INPUT -p tcp -m tcp -s 192.168.0.100 --dport 137 -j ACCEPT
## END ##

## Drop outside initiated connections
-A INPUT -m state --state NEW -j REJECT

## Allow inbound established and related outside communication
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## Necessary for iptables-restore
COMMIT

gilead · 03-02-2006, 09:58 PM

OK, the rules look fine. According to man iptables, the "exact rules are suppressed until you use iptables -L -v" Can you run that and post the output please?

stny · 03-03-2006, 10:38 PM

Quote:

Originally Posted by gilead

OK, the rules look fine. According to man iptables, the "exact rules are suppressed until you use iptables -L -v" Can you run that and post the output please?

Following is the output of the "iptables -L -v":
when using the -L and -v to list out the table rule,
i think the first rule is accept the location connection...

the problem may be using wrong command option to list out the rule

Quote:

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 ACCEPT icmp -- any any anywhere anywhere
0 0 REJECT all -- any any anywhere anywhere state NEW reject-with icmp-port-unreachable
0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any lo anywhere anywhere

gilead · 03-04-2006, 05:34 AM

I'd say you're right - with the lo displaying in the output, it's easier to understand.