Solved

iptables Question - Default policy

Posted on 2006-11-08
2
157 Views
Last Modified: 2012-05-05
Using the example below, all incoming packets are automatically dropped (ie ignored) for the workstation unless
-The packets are for udp ports 137 through 139 and originate from an IP address of 66.66.66.66
-The packets are for tcp port 445 and originate from an IP address of 66.66.66.66.  
-The packets are used for loopback

Am I interpreting this correctly?  

What is the established/related entry useful for?

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m udp -s 66.66.66.66 --dport 137:139 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp - m tcp -s 66.66.66.66 --dport 445 -j ACCEPT
0
Comment
Question by:BendOverIGotYourBack
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 43

Accepted Solution

by:
ravenpl earned 125 total points
ID: 17904654
You are correct.
> iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
In short it means to accept packets that comes within already started connections(ESTABLISHED) - usually those are connections initiated from the box itself - in other words all outgoing connaections are permitted(since iptables -P OUTPUT ACCEPT)
Also RELATED connections are fine. There are some cases, where connecting to Your host requires two connections. A good examples are ftp and auth protocols.
0
 

Author Comment

by:BendOverIGotYourBack
ID: 17942124
thank you.
0

Featured Post

Containers and Docker for Everyone

Containers are an incredibly powerful technology that can provide you and/or your engineering team with huge productivity gains. Using containers, you can deploy, back up, replicate, and move apps and their dependencies quickly and easily.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
Fine Tune your automatic Updates for Ubuntu / Debian
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question