Hi Mike, Sorry for the late reply. I have been busy since morning. I see that some of your questions have been answered by Jason & Alistair. Let me first answer your 2nd question: - If you are not using a "chain" for setting up rules but set the default policy to "drop" and if a packet traverses that chain then it will be dropped. Hence by putting rules, I classify packets that I want to allow. The rest will be dropped by default. I guess your 1st question is answered now: Yes, rules appended will override the default policies. This is how I would write the policies to achieve your goal: Default policy for chains in Mangle & Nat tables to ACCEPT. Default policy for chains in filter table to DROP. Open dports ports 80 & 22 on the INPUT, FORWARD & OUTPUT chains. Enable stateful firewall rules on these chains. ACCEPT only NEW packets. I do not know the port # for samba services. Hey, I am glad the diagram worked out for ya. Hope this helps. Take care, Deepak Seshadri -----Original Message----- From: Mike [mailto:1100100@xxxxxxxxx] Sent: Wednesday, September 01, 2004 11:46 AM To: Deepak Seshadri Cc: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Re: Policy Misunderstanding: RTFM Guidance Requested. Hi Deepak, Thank you for your response. On Wed, 1 Sep 2004 09:27:22 -0400, Deepak Seshadri <dseshadri@xxxxxxxxxxxxxxxxxxxxx> wrote: > > If the default policy on your mangle & Nat chain is set to DROP & if you > have no rules to classify traffic in these tables, all your packets will get > dropped here. They will not make it to the FILTER table. This is a good point and shows where maybe I am starting to MIS-understand. 1. Can appended rules override default polices? 2. Do you need to include appended rules to parts of the iptables chain that you are not using, or else all the packets will get dropped? For example, do you have to set Mangle rules even if you are not using any Mangling but have set a DROP policy for mangling. > > In your commands, first you have set the default policy to DROP on all > chains in the filter table. Then you have set policies to accept all the > traffic in the INPUT & OUTPUT chains. I do not get this. If you are aiming > to accept all packets in the INPUT & OUTPUT chain you might as well set the > default policy in these chains to ACCEPT. I understand your point here. I used those -j ACCPT rules because everything else has failed so far to override the DROP policy, so that was a last resort desperately trying to get some packets through the routerbox. I really don't want to accept everything blindly on the INPUT and OUTPUT of the routerbox. I would actually like to set INPUT/OUTPUT rules that only allow traffic on a few different ports for web browsing, ssh access, and network samba; close everything else. > I will email you a diagram on the packet flow inside the kernel. Probably > that would make things easier in understanding where each chain exists > inside the kernel. > Hey now, thanks for the diagram. This is pretty cool stuff. I need a few months to figure it all out though. :-) Please write back on the other issues above if you have a chance. Hope to hear from you. Thanks, Mike
