We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, that I'm not reading it correctly. I cannot post the entire iptables for security reasons, but here is what the vendor is saying:
Trust me it's locked down. I cannot educate any customer on iptables, but you can reference iptables documentation online to better understand how each rule is setup e.g. The Beginner’s Guide to iptables, the Linux Firewall
Example below, this is the DROP policy not the allow policy, take note of that vs reading ACCEPT all anywhere and thinking it's open.
Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere
Later they said
are all ports open?
No. Iptables is not like a pam configuration file where the first rule satisfies a procedure. In iptables, ALL rules must be satisfied. If there were no ACCEPT all anywhere , nothing would get through the firewall.
To me, it doesn't make sense. The example starts with accept any any any
and the policy is drop. From what I read online, policy drop is just setting it to deny by default instead of accept by default. I don't understand how setting the example to policy drop or accept would change the outcome.
What am I missing?
iptables -L -vn
then you can see counters for each rule, including the default policy for the chain. That way you can check whether anything is actually blocked by the default policy, despite the "allow everything" that seems to be in place. Note also that the first rule that does an ACCEPT, DROP or REJECT will terminate processing of that packet, I have no idea what they thought they were saying with "ALL rules must be satisfied". Also check thenat
andmangle
tables for completeness, BTW. – wurtel Nov 7 '14 at 15:23