3

Does iptables -I INPUT -j ACCEPT open all ports?

3
  • Why don't you just try it and see? Type sudo iptables -L after executing it. Also, try to generate some network traffic to see if it's allowed/denied.
    – sakisk
    Apr 1, 2011 at 19:35
  • @faif: Experimenting can be tricky: if you try a little traffic and see everything accepted, you can't be sure there aren't some obscure packets that will be rejected. Better advice is to read the documentation, this is an extremely simple case. Apr 1, 2011 at 19:47
  • 2
    It can be really tricky if you're remoted in via ssh. Apr 1, 2011 at 19:53

4 Answers 4

5

This will accept all traffic that is inbound and destined for this computer; all ports, all protocols, all users, all states. Remember that port isn't the only thing you have to think about when writing a firewall on a Linux System. Any traffic that is outbound or destined for another computer may have different rules. However if your rules are this, for example

iptables -I INPUT -j ACCEPT
iptables -I INPUT -j DROP

the second rule will end up being before the first and all traffic will be dropped. If you want to allow all traffic. I generally recommend using -A instead of -I when writing a firewall script so the order is obvious. Also if you just want to allow everything, you'd be better off setting the policy for the chain.

iptables -P INPUT ACCEPT

will tell everything that hasn't matched another rule at the end of INPUT to be allowed.

3

iptables -I INPUT -j ACCEPT

The above command will INSERT (-I) a new rule at chain position 1 (understood by omission) that matches every packet crossing the INPUT chain (because their are no filters) and will ACCEPT it.

1

Yes. This command creates a rule that will be checked first (-I) for incoming packets (INPUT); the rule matches every packet (no filter) and allows them (-j ACCEPT).

0

Yes, provided that the packet is not dropped in -t raw.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .