Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Redhat EL 6, iptables INPUT policy is ACCEPT but INPUT chain has REJECT entry in the end. /etc/syconfig/iptables is as below:

-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Do you know why the policy is ACCEPT not DROP? I think setting DROP policy is safer than ACCEPT in case to make mistake in the chain. Actually the policy is not applied to any packet:

# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
share|improve this question

The policies affect what happens when traffic is not "caught" by any other rule.

DROP policy is a good idea if you are hardening your server. It is probably not like that by default because there's no way for the distribution maintainers to know how you'll use the system or what services you'll have active on the system in advance.

share|improve this answer

Since the last rule in the chain matches all packets, the default policy isn't ever used. Using a catch all rule to reject remaining traffic allows the reject method to be selected, and is also more obvious when looking at iptables -nvL output. You could change it to REJECT or DROP if you wanted, but it's not going to change the behaviour.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .