0

The first rule in the FORWARD chain is interesting to me. Why would this be a necessary rule if the policy is to DROP?

root@tomato:/tmp/home/root# iptables -L --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    REJECT     tcp  --  anywhere             tomato               multiport dports www,https,ssh reject-with tcp-reset
2    REJECT     tcp  --  anywhere             tomato-lan1          multiport dports www,https,ssh reject-with tcp-reset
3    DROP       all  --  anywhere             anywhere             state INVALID
4    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
5    shlimit    tcp  --  anywhere             anywhere             tcp dpt:ssh state NEW
6    ACCEPT     all  --  anywhere             anywhere
7    ACCEPT     all  --  anywhere             anywhere
8    ACCEPT     all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
num  target     prot opt source               destination
1    REJECT     tcp  --  anywhere             tomato               multiport dports www,https,ssh reject-with tcp-reset
2    REJECT     tcp  --  anywhere             tomato-lan1          multiport dports www,https,ssh reject-with tcp-reset
3    ACCEPT     all  --  anywhere             anywhere
4    ACCEPT     all  --  anywhere             anywhere
5    DROP       all  --  anywhere             anywhere             state INVALID
6    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
7    DROP       all  --  anywhere             anywhere
8    DROP       all  --  anywhere             anywhere
9    wanin      all  --  anywhere             anywhere
10   wanout     all  --  anywhere             anywhere
11   ACCEPT     all  --  anywhere             anywhere
12   ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain shlimit (1 references)
num  target     prot opt source               destination
1               all  --  anywhere             anywhere             recent: SET name: shlimit side: source
2    DROP       all  --  anywhere             anywhere             recent: UPDATE seconds: 60 hit_count: 4 name: shlimit side: source

Chain wanin (1 references)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  anywhere             oldtimer             tcp dpt:3300

Chain wanout (1 references)
num  target     prot opt source               destination
0

1) The rules are automatically generated by some program that takes a higher-level description. Don't make the assumption a rule is "necessary" just because it appears there.

2) Even if a rule is not strictly necessary, it can be good practice to include it, to explicitly state that something is not allowed.

3) That said, it can be actually necessary to include this rule, namely if there are other rules which would accept the packet before the end of the table is reached and the default DROP policy applies.

In particular, rules 11 and 12 in the FORWARD chain look identical and seem to accept everything (so they probably have attributes that are not listed; try -S instead of -L), if that is indeed the case, that is the same as a default policy of ACCEPT, so you'd have to drop everything explicitely you want to drop.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.