We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, that I'm not reading it correctly. I cannot post the entire iptables for security reasons, but here is what the vendor is saying:
Trust me it's locked down. I cannot educate any customer on iptables, but you can reference iptables documentation online to better understand how each rule is setup e.g. http://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/
Example below, this is the DROP policy not the allow policy, take note of that vs reading ACCEPT all anywhere and thinking it's open.
Chain INPUT (policy DROP) target prot opt source
destination ACCEPT all -- anywhere anywhere
Later they said
- are all ports open?
No. Iptables is not like a pam configuration file where the first rule satisfies a procedure. In iptables, ALL rules must be satisfied. If there were no ACCEPT all anywhere , nothing would get through the firewall.
To me, it doesn't make sense. The example starts with
accept any any any and the policy is drop. From what I read online, policy drop is just setting it to deny by default instead of accept by default. I don't understand how setting the example to policy drop or accept would change the outcome.
What am I missing?