I'd like to understand what is specifically happening to incoming packets that don't explicitly match rules in my iptables chains. Is the default action to reject them? Or drop them? How/where can I set this?
Here's an example output of my firewall setup (some ports have been modified to protect the innocent :-) ) :
Chain INPUT (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination RH-Firewall-1-INPUT all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain RH-Firewall-1-INPUT (2 references) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere icmp any ACCEPT esp -- anywhere anywhere ACCEPT ah -- anywhere anywhere ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:456 REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
The key point though is that I have a different chain called
RH-Firewall-1-INPUT that doesn't have an explicit
(policy ACCEPT) or
(policy REJECT) statement. What would be the default behavior for that (assuming of course that I'm NOT matching any of the prior rules). Is the last line just a "catch all"?