On Tue, Feb 18, 2003 at 11:15:21AM +0100, Patrick Maartense wrote: > it would be MUCH better to > > iptables -p INPUT DROP # default drop > then allow only these ports > iptables -A INPUT -p tcp -m multiport --dport 21,22,80,8080 -j ACCEPT > > safe thinking: Default : drop, allow only what needed. And it's allways a good idea to allow traffic from loopback: iptables -A INPUT -i lo -j ACCEPT I heard people telling that ssh is using 22/udp as well. I'm not sure if that's true, though i haven't found any sshd which ever bind()ed to 22/udp. Anyone more information? Allowing ICMP should be mandatory as well, otherwise you'll create another PMTU blackhole and you'll miss almost all error messages. And sending real errormessages like tcp-reset and ICMP port unreachable is a good thing, too. You can limit them, if you like. iptables -A INPUT -p icmp -m limit --limit 5/s -j ACCEPT iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset # limit if you like iptables -A INPUT -j REJECT # and that one as well # implicit DROP due to default policy should happen here Alex. -- "Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal." Instructions for use of this post: Insert tounge in cheek. Read as normal.
Attachment:
pgp00336.pgp
Description: PGP signature
