iptables, what is truly open?

Question

We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, that I'm not reading it correctly. I cannot post the entire iptables for security reasons, but here is what the vendor is saying:

Trust me it's locked down. I cannot educate any customer on iptables, but you can reference iptables documentation online to better understand how each rule is setup e.g. The Beginner’s Guide to iptables, the Linux Firewall

Example below, this is the DROP policy not the allow policy, take note of that vs reading ACCEPT all anywhere and thinking it's open.

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Later they said

1. are all ports open?

   No. Iptables is not like a pam configuration file where the first rule satisfies a procedure. In iptables, ALL rules must be satisfied. If there were no ACCEPT all anywhere , nothing would get through the firewall.

To me, it doesn't make sense. The example starts with accept any any any and the policy is drop. From what I read online, policy drop is just setting it to deny by default instead of accept by default. I don't understand how setting the example to policy drop or accept would change the outcome.

What am I missing?

Answer 1

Iptables is not like a pam configuration file where the first rule satisfies a procedure. In iptables, ALL rules must be satisfied.

This is completely wrong. The rules are traversed in order, and when a rule that matches jumps to one of the built-in targets (ACCEPT, DROP or QUEUE), the processing of the packet ends there: no more rules are traversed. The later assertion that “If there were no ACCEPT all anywhere, nothing would get through the firewall” is true (with a DROP policy), but a packet doesn't have to match all ACCEPT rules to be true, it only has to reach one.

It's possible for a packet to be processed by several matching rules, because there can be rules that jump to user-defined chains (in which case the rules in the chain are tried in order), or that doesn't jump at all and is only present for some other reason such as logging. But once ACCEPT or DROP is reached, that's it, the packet is either sent or discarded; if QUEUE is reached, the packet is passed to userland for further processing; and either way no more rules are processed for this packet. Finally, if (and only if) the processing reaches the end of a built-in chain, the chain's policy is applied.

For example, suppose that iptables -L shows

Chain INPUT (policy DROP) target prot opt source
destination ACCEPT all -- anywhere anywhere

Since the policy is DROP, only packets explicitly ACCEPTed by some rule will make it through. The one rule looks like it accepts everything, but this is not necessarily the case: there could be conditions that iptables -L omits. Run iptables -vL to print out all conditions. A common omitted condition is the interface; having a rule that accepts all loopback traffic is pretty common. You would see something like

# iptables -L INPUT 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
# iptables -vL INPUT
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            

If the rule accepted all traffic, you'd see any in the in column from iptables -vL INPUT.