Re: Learning iptables

[Thomas Jacob <jacob@internet24.de>]

On Sat, Apr 18, 2009 at 09:32:58AM -0300, Leonardo Carneiro wrote:
> Is there any good reason why someone would set an ACCEPT policy for all  
> chains first to withdraw some later? What the benefit of doing this?

If I'd have to guess at the ruleset authors intentions, I'd say
s/he wanted to prevent service disruptions when reloading the
firewall scripts.

Loading a lot of rules without iptables-restore can take quite some time,
and if you have a DROP policy during the rule loading time,
some packets that your final ruleset would pass thru will be dropped.
Also, if your scripts terminate prematurely, you might not be able
to remote access your machine anymore.

But then again, you should load your ruleset before you bring up
your network, so the first reason should be irrelevant. And the
second shouldn't really matter after the initial testing phase.