Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to ask in ubuntu 12.04, there is no firewall settings by default?

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

However we have default firewall setting that already block major ports already in Centos/Fedora?

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:webcache 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:webcache 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:8090 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

I would like to ask if there is nth to set in ChainINPUT, does it mean it doesn't block anything in Ubuntu? But what about Centos iptables, it seems other ports are blocked except, webcache 8080, 8090, and ssh port (22)

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Yes, if the chain INPUT is empty and its policy is set to ACCEPT then NetFilter (iptables) does not filter anything. I would recommend you to set up a minimal set from your second sample excluding all state NEW rules but probably ssh rule if you need to access this host with ssh. Alternatively you could use Ubuntu's ufw tool to configure it.

And yes, you understood it right that in the second example all ports are locked but ssh, 8080 and 8090.

share|improve this answer
    
which line stating that in second example that all ports are blocks? –  Kit Ho Oct 16 '12 at 0:18
    
the last one: REJECT all -- anywhere anywhere reject-with icmp-host-prohibited –  Serge Oct 16 '12 at 0:19
    
What was Ubuntu thinking? –  rjt Oct 3 '13 at 19:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.