> On Tue, Feb 18, 2003 at 11:15:21AM +0100, Patrick Maartense wrote: > > it would be MUCH better to > > > > iptables -p INPUT DROP # default drop > > then allow only these ports > > iptables -A INPUT -p tcp -m multiport --dport 21,22,80,8080 -j ACCEPT > > > > safe thinking: Default : drop, allow only what needed. > > And it's allways a good idea to allow traffic from loopback: > iptables -A INPUT -i lo -j ACCEPT Another Question when i put this line in iptables -L say Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere whit this i do open all ports for any connection of outside????? who is the line to permit all inside to outside?? > > I heard people telling that ssh is using 22/udp as well. I'm not sure if > that's true, though i haven't found any sshd which ever bind()ed to 22/udp. > Anyone more information? > > Allowing ICMP should be mandatory as well, otherwise you'll create another > PMTU blackhole and you'll miss almost all error messages. And sending real > errormessages like tcp-reset and ICMP port unreachable is a good thing, too. > You can limit them, if you like. > > iptables -A INPUT -p icmp -m limit --limit 5/s -j ACCEPT > iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset # limit if you like > iptables -A INPUT -j REJECT # and that one as well > # implicit DROP due to default policy should happen here > > Alex. > > > -- > "Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal." > Instructions for use of this post: Insert tounge in cheek. Read as normal. ---end quoted text--- -- Pablo Allietti LACNIC Registro de Direcciones de Internet para America Latina y el Caribe Registro de Enderecamento de Internet para America Latina e Caribe Latin American and Caribbean Internet Addresses Registry
