We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, that I'm not reading it correctly. I cannot post the entire iptables for security reasons, but here is what the vendor is saying:

Trust me it's locked down. I cannot educate any customer on iptables, but you can reference iptables documentation online to better understand how each rule is setup e.g. http://www.howtogeek.com/177621/the-beginners-guide-to-iptables-the-linux-firewall/

Example below, this is the DROP policy not the allow policy, take note of that vs reading ACCEPT all anywhere and thinking it's open.

Chain INPUT (policy DROP) target prot opt source
destination ACCEPT all -- anywhere anywhere

Later they said

  1. are all ports open?

No. Iptables is not like a pam configuration file where the first rule satisfies a procedure. In iptables, ALL rules must be satisfied. If there were no ACCEPT all anywhere , nothing would get through the firewall.

To me, it doesn't make sense. The example starts with accept any any any and the policy is drop. From what I read online, policy drop is just setting it to deny by default instead of accept by default. I don't understand how setting the example to policy drop or accept would change the outcome.

What am I missing?

  • 1
    I'm not certain, but if you're saying your INPUT chain has that ACCEPT rule as the first rule, then yes, it's wide open. Also "In iptables, ALL rules must be satisfied" is false. They have no clue what they're talking about if they're claiming this. – Patrick Nov 7 '14 at 13:16
  • If this is some vendor responsible for ensuring the security of your systems, I would stop using them. I'm completely serious. Minor mistakes might be forgivable, but if this is what they're claiming, they are obviously clueless and might even be making your system security worse. – Patrick Nov 7 '14 at 13:22
  • According to them this is a prehardened appliance, the appliance is from EMC2/RSA. We are under regulations requiring us to prove that only those ports and services required for normal and emergency operations are enabled. I can't prove it... it appears wide open. Also they say modifying anything at the CLI level will void the warranty, so we are stuck in a bad spot. – gunslingor Nov 7 '14 at 13:42
  • 2
    If you list the rules with iptables -L -vn then you can see counters for each rule, including the default policy for the chain. That way you can check whether anything is actually blocked by the default policy, despite the "allow everything" that seems to be in place. Note also that the first rule that does an ACCEPT, DROP or REJECT will terminate processing of that packet, I have no idea what they thought they were saying with "ALL rules must be satisfied". Also check the nat and mangle tables for completeness, BTW. – wurtel Nov 7 '14 at 15:23

Iptables is not like a pam configuration file where the first rule satisfies a procedure. In iptables, ALL rules must be satisfied.

This is completely wrong. The rules are traversed in order, and when a rule that matches jumps to one of the built-in targets (ACCEPT, DROP or QUEUE), the processing of the packet ends there: no more rules are traversed. The later assertion that “If there were no ACCEPT all anywhere, nothing would get through the firewall” is true (with a DROP policy), but a packet doesn't have to match all ACCEPT rules to be true, it only has to reach one.

It's possible for a packet to be processed by several matching rules, because there can be rules that jump to user-defined chains (in which case the rules in the chain are tried in order), or that doesn't jump at all and is only present for some other reason such as logging. But once ACCEPT or DROP is reached, that's it, the packet is either sent or discarded; if QUEUE is reached, the packet is passed to userland for further processing; and either way no more rules are processed for this packet. Finally, if (and only if) the processing reaches the end of a built-in chain, the chain's policy is applied.

For example, suppose that iptables -L shows

Chain INPUT (policy DROP) target prot opt source
destination ACCEPT all -- anywhere anywhere

Since the policy is DROP, only packets explicitly ACCEPTed by some rule will make it through. The one rule looks like it accepts everything, but this is not necessarily the case: there could be conditions that iptables -L omits. Run iptables -vL to print out all conditions. A common omitted condition is the interface; having a rule that accepts all loopback traffic is pretty common. You would see something like

# iptables -L INPUT 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
# iptables -vL INPUT
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            

If the rule accepted all traffic, you'd see any in the in column from iptables -vL INPUT.

  • 100% correct... after hours of research and fighting with RSA, I finally found the correct commands to run (i.e. "/etc/sysconfig # cat iptables" and "iptables -L -vn"). The vendor provide the lesser command that was missing the key information of in=lo=localhost interface and was telling me I was reading it wrong... no, you gave me the wrong command! Now it is clear that yes, the first rule is accept any any any, but only for the local host interface. – gunslingor Nov 14 '14 at 17:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.