Solved

iptables Question - Default policy

Posted on 2006-11-08
2
155 Views
Last Modified: 2012-05-05
Using the example below, all incoming packets are automatically dropped (ie ignored) for the workstation unless
-The packets are for udp ports 137 through 139 and originate from an IP address of 66.66.66.66
-The packets are for tcp port 445 and originate from an IP address of 66.66.66.66.  
-The packets are used for loopback

Am I interpreting this correctly?  

What is the established/related entry useful for?

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m udp -s 66.66.66.66 --dport 137:139 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp - m tcp -s 66.66.66.66 --dport 445 -j ACCEPT
0
Comment
Question by:BendOverIGotYourBack
2 Comments
 
LVL 43

Accepted Solution

by:
ravenpl earned 125 total points
ID: 17904654
You are correct.
> iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
In short it means to accept packets that comes within already started connections(ESTABLISHED) - usually those are connections initiated from the box itself - in other words all outgoing connaections are permitted(since iptables -P OUTPUT ACCEPT)
Also RELATED connections are fine. There are some cases, where connecting to Your host requires two connections. A good examples are ftp and auth protocols.
0
 

Author Comment

by:BendOverIGotYourBack
ID: 17942124
thank you.
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
iptables on bridged interface 4 106
IPA complaining about DNS but DNS looks good.... 2 133
monitor and log every file access on redhat/linux 4 132
lunix and unix command 21 85
​Being a Managed Services Provider (MSP) has presented you  with challenges in the past— and by meeting those challenges you’ve reaped the rewards of success.  In 2014, challenges and rewards remain; but as the Internet and business environment evol…
Fine Tune your automatic Updates for Ubuntu / Debian
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question