I know you already have your answer (from Neal Murphy) , but I feel I need to mention that your RULE makes no sense in a pratical manner ! Now your rules are not working because the order is incorrect for your *plans* , but this even if you change the order , your setup makes less sense than do things the "normal" way . To make the current set work you would not only have to change the order , But making new openings would require you to change one single rule with removing some ports from your DROP rule . iptables -A INPUT -p tcp ! -i lo -m multiport --dports 0:79,81:65535 -m state --state NEW -j DROP iptables -A INPUT -p tcp -j ACCEPT iptables -A INPUT -p udp -j ACCEPT next time you would make a more complex multiport rule ... iptables -A INPUT -p tcp ! -i lo -m multiport --dports 0:21,23:79,81:65535 -m state --state NEW -j DROP iptables -A INPUT -p tcp -j ACCEPT iptables -A INPUT -p udp -j ACCEPT next time you would make a even more complex multiport rule ... iptables -A INPUT -p tcp ! -i lo -m multiport --dports 0:21,23:79,81:442,444:65535 -m state --state NEW -j DROP iptables -A INPUT -p tcp -j ACCEPT iptables -A INPUT -p udp -j ACCEPT This makes very little sense when you can just make ONE accept for all , and drop the rest ! iptables -A INPUT -p tcp -i lo -m multiport --dports 22,80,443 -j ACCEPT iptables -A INPUT -j DROP I will mention I also removed your "iptables -A INPUT -p udp -j ACCEPT" , and I would have replaced that with one that gives the ports you want opened before the DROP rule . Kind Regards André -----Original Message----- From: netfilter-owner@xxxxxxxxxxxxxxx [mailto:netfilter-owner@xxxxxxxxxxxxxxx] On Behalf Of dE Sent: 19. mars 2015 06:52 To: netfilter@xxxxxxxxxxxxxxx Subject: DROP policy, serious vulnerability? Hi! I'm using the drop policy for iptables using the following -- iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A INPUT -p tcp -j ACCEPT iptables -A INPUT -p udp -j ACCEPT iptables -A INPUT -p tcp ! -i lo -m multiport --dports 0:79,81:65535 -m state --state NEW -j DROP Unfortunately, in this configuration, none of the ports get blocks. This implies that after an ACCEPT, further rules are not matched. Is this a bug or intended by design? If this is by design, how am I supposed to use modules like connlimit with DROP policy. Thanks for any help! -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html ��.n��������+%������w��{.n����z���)�� jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
