Re: Best Practices for iptables

[Ray Leach <raymondl@knowledgefactory.co.za>]

[-- Attachment #1: Type: text/plain, Size: 1273 bytes --]

On Fri, 2003-12-05 at 16:01, Gabby James wrote:
> Hi,
> 
> I want to allow everything on eth1 and be selective on eth0.  What is the 
> best way of handling unwanted packets?
> 
> A) Change the policy of the chain to DROP then allow what I want.  Example:
> iptables -P INPUT DROP
> iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
> 
> 
> B) or leave the policy of the INPUT chain to ACCEPT but put REJECT rules at 
> the end. Example:
> iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j ACCEPT
> iptables -A INPUT -p tcp -m tcp -j REJECT
> iptables -A INPUT -p udp -m udp -j REJECT
> iptables -A INPUT -p icmp -j DROP
> 
> This will give me the same outcome won't it?
No, none of your rules reference the interface, e.g -i eth0
So your rules allow/reject on all interfaces.

> 
> Thanks in advance!
> 
> _________________________________________________________________
> Winterize your home with tips from MSN House & Home. 
> http://special.msn.com/home/warmhome.armx
-- 
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD  00EE 8757 EE47 F06F FB28
--

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]