Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Does iptables -I INPUT -j ACCEPT open all ports?

share|improve this question
    
Why don't you just try it and see? Type sudo iptables -L after executing it. Also, try to generate some network traffic to see if it's allowed/denied. –  faif Apr 1 '11 at 19:35
    
@faif: Experimenting can be tricky: if you try a little traffic and see everything accepted, you can't be sure there aren't some obscure packets that will be rejected. Better advice is to read the documentation, this is an extremely simple case. –  Gilles Apr 1 '11 at 19:47
2  
It can be really tricky if you're remoted in via ssh. –  xenoterracide Apr 1 '11 at 19:53

4 Answers 4

up vote 3 down vote accepted

This will accept all traffic that is inbound and destined for this computer; all ports, all protocols, all users, all states. Remember that port isn't the only thing you have to think about when writing a firewall on a Linux System. Any traffic that is outbound or destined for another computer may have different rules. However if your rules are this, for example

iptables -I INPUT -j ACCEPT
iptables -I INPUT -j DROP

the second rule will end up being before the first and all traffic will be dropped. If you want to allow all traffic. I generally recommend using -A instead of -I when writing a firewall script so the order is obvious. Also if you just want to allow everything, you'd be better off setting the policy for the chain.

iptables -P INPUT ACCEPT

will tell everything that hasn't matched another rule at the end of INPUT to be allowed.

share|improve this answer

Yes. This command creates a rule that will be checked first (-I) for incoming packets (INPUT); the rule matches every packet (no filter) and allows them (-j ACCEPT).

share|improve this answer

iptables -I INPUT -j ACCEPT

The above command will INSERT (-I) a new rule at chain position 1 (understood by omission) that matches every packet crossing the INPUT chain (because their are no filters) and will ACCEPT it.

share|improve this answer

Yes, provided that the packet is not dropped in -t raw.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.