1

the filter table in my ip tables stats the :INPUT DROP[0:0], but when I type sudo iptables -L, The policy says that it accepts them, I also have a nat table which does accept INPUT, but I even tried doing sudo iptables -t filter -L in order to ensure I was looking at the filter table.

OS: Raspbian Stretch Lite

/etc/network/iptable

(Shortened the table for simplicity)

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

When I do the following command to show the polices, I get the following results:

sudo iptables -t filter -L

Chain INPUT (policy ACCEPT)
target    prot opt source           destination

Chain FORWARD (policy ACCEPT)
target    prot opt source           destination

Chain OUTPUT (policy ACCEPT)
target    prot opt source           destination

and I check the nat table just to see if that might be having any issues but the nat table seems fine.

sudo iptable - t nat -L

Chain PREROUTING (policy ACCEPT)
target    prot opt source           destination

Chain INPUT (policy ACCEPT)
target    prot opt source           destination

Chain OUTPUT (policy ACCEPT)
target    prot opt source           destination

Chain POSTROUTING (policy ACCEPT)
target    prot opt source           destination

I tried rebooting the system to see whether that might have been the issue, but I still end up getting the same results.

  • 1
    So your issues is that the output of iptables is not what you would expect given the content of the file at /etc/network/iptable? – datUser Mar 1 at 18:23
  • Yes exactly good sir – david yeritsyan Mar 1 at 18:25
1

This is the format for iptables-apply or iptables-restore to apply the rules:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

While sudo iptables -t filter -L shows the actual status.

You have to apply the policies to take effect. See:

man iptables-apply

Or:

man iptables-restore 
  • I'll read the documentation rn appreciate it, I tried running the command for the hell of it and noticed that when using raspbian stretch lite the directory is as follows '/etc/network/iptables', vs the default for this command being, '/etc/network/iptables.up.rules' – david yeritsyan Mar 1 at 18:31
  • 1
    I don't know about the defaults. From my experience, the redirection has to be set explicitly and a firewall service has to be written. Maybe this will interest you: github.com/tomasz-warniello/Waterwall @davidyeritsyan – Tomasz Mar 1 at 18:36
  • iptables-restore < /etc/network/iptables , this did the trick thank you – david yeritsyan Mar 1 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.