In Redhat EL 6, iptables INPUT policy is ACCEPT but INPUT chain has REJECT entry in the end. /etc/syconfig/iptables is as below:

-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Do you know why the policy is ACCEPT not DROP? I think setting DROP policy is safer than ACCEPT in case to make mistake in the chain. Actually the policy is not applied to any packet:

# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

The policies affect what happens when traffic is not "caught" by any other rule.

DROP policy is a good idea if you are hardening your server. It is probably not like that by default because there's no way for the distribution maintainers to know how you'll use the system or what services you'll have active on the system in advance.


Since the last rule in the chain matches all packets, the default policy isn't ever used. Using a catch all rule to reject remaining traffic allows the reject method to be selected, and is also more obvious when looking at iptables -nvL output. You could change it to REJECT or DROP if you wanted, but it's not going to change the behaviour.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.