Re: Learning iptables

[Leonardo Carneiro <lscarneiro@veltrac.com.br>]

Tks Thomas and Brian. It was very helpful.
Now i'll follow with my jorney _o/

tks again! =)

Thomas Jacob escreveu:
> On Sat, Apr 18, 2009 at 09:32:58AM -0300, Leonardo Carneiro wrote:
>   
>> Is there any good reason why someone would set an ACCEPT policy for all  
>> chains first to withdraw some later? What the benefit of doing this?
>>     
>
> If I'd have to guess at the ruleset authors intentions, I'd say
> s/he wanted to prevent service disruptions when reloading the
> firewall scripts.
>
> Loading a lot of rules without iptables-restore can take quite some time,
> and if you have a DROP policy during the rule loading time,
> some packets that your final ruleset would pass thru will be dropped.
> Also, if your scripts terminate prematurely, you might not be able
> to remote access your machine anymore.
>
> But then again, you should load your ruleset before you bring up
> your network, so the first reason should be irrelevant. And the
> second shouldn't really matter after the initial testing phase.
>
>   


-- 

*Leonardo de Souza Carneiro*
*Veltrac - Tecnologia em Logística.*
lscarneiro@veltrac.com.br <mailto:lscarneiro@veltrac.com.br>
http://www.veltrac.com.br <http://www.veltrac.com.br/>
/Fone Com.: (43)2105-5600/
/Av. Higienópolis 1601 Ed. Eurocenter Sl. 803/
/Londrina- PR/
/Cep: 86015-010/