1

I would like to ask in ubuntu 12.04, there is no firewall settings by default?

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

However we have default firewall setting that already block major ports already in Centos/Fedora?

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:webcache 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:webcache 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:8090 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

I would like to ask if there is nth to set in ChainINPUT, does it mean it doesn't block anything in Ubuntu? But what about Centos iptables, it seems other ports are blocked except, webcache 8080, 8090, and ssh port (22)

1 Answer 1

1

Yes, if the chain INPUT is empty and its policy is set to ACCEPT then NetFilter (iptables) does not filter anything. I would recommend you to set up a minimal set from your second sample excluding all state NEW rules but probably ssh rule if you need to access this host with ssh. Alternatively you could use Ubuntu's ufw tool to configure it.

And yes, you understood it right that in the second example all ports are locked but ssh, 8080 and 8090.

3
  • which line stating that in second example that all ports are blocks?
    – TheOneTeam
    Oct 16, 2012 at 0:18
  • the last one: REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
    – Serge
    Oct 16, 2012 at 0:19
  • What was Ubuntu thinking?
    – rjt
    Oct 3, 2013 at 19:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .