Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In Redhat EL 6, iptables INPUT policy is ACCEPT but INPUT chain has REJECT entry in the end. /etc/syconfig/iptables is as below:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Do you know why the policy is ACCEPT not DROP? I think setting DROP policy is safer than ACCEPT in case to make mistake in the chain. Actually the policy is not applied to any packet:

# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
share|improve this question

2 Answers 2

The policies affect what happens when traffic is not "caught" by any other rule.

DROP policy is a good idea if you are hardening your server. It is probably not like that by default because there's no way for the distribution maintainers to know how you'll use the system or what services you'll have active on the system in advance.

share|improve this answer

Since the last rule in the chain matches all packets, the default policy isn't ever used. Using a catch all rule to reject remaining traffic allows the reject method to be selected, and is also more obvious when looking at iptables -nvL output. You could change it to REJECT or DROP if you wanted, but it's not going to change the behaviour.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.