IPTABLES Question

lucktsm · 05-24-2006, 08:58 AM

This line:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Just to verify.... this means that if a connection has already connected don't check each packet? Or is this saying allow everything?

I am just wondering because I added it to improve the performance of my firewall because I have an extensive block list. Now Snort is picking up bad traffic from IP's I have already blocked.

Thanks for your input...

anomie · 05-24-2006, 11:28 PM

FWIW, I like the

Code:

iptables -nvL

listing a little better (seems more clear to me).

Have a look at the manpages for iptables for exact definitions on what RELATED and ESTABLISHED mean. But it sounds like you have the gist of it (in your first question anyway).

Also, remember that with an INPUT chain policy of ACCEPT, you're going to ACCEPT any packets that don't match other rules in the chain....

lucktsm · 05-25-2006, 12:25 PM

Thank you, I thought that was the case. I am starting to understand this animal (that's the scary part)

ThisGuyIKnow · 06-02-2006, 11:30 AM

Hi,

I also wanted to give thanks to anomie for the little tidbit on using iptables w/ options -nvL. I'm using SuSEfirewall2 and was simply using iptables -L to look at my rules. When looking at the first rule of my INPUT chain it didn't make sense why my firewall was working:

Code:

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere

I thought "holy #$*&! Accept all packets from anywhere to anywhere?" But I tested my firewall and saw in my logs that it was indeed dropping things that it was supposed to drop. Then I browsed around LQ and found this thread and ran iptables -nvL:

Code:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   40  2512 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0

"Oh, accept all packets on the loopback interface... whew!"