From: Christian Seberino <seberino@spawar.navy.mil>
To: Ed Street <blacknet@simplyaquatics.com>
Cc: netfilter@lists.samba.org
Subject: Re: Default DROP policy for mangle and nat in iptables necessary/wise?
Date: Mon, 24 Jun 2002 16:36:50 -0700 [thread overview]
Message-ID: <20020624163650.A5016@spawar.navy.mil> (raw)
In-Reply-To: <001e01c21bb1$a95115a0$0a01a8c0@ed>; from blacknet@simplyaquatics.com on Mon, Jun 24, 2002 at 03:02:18PM -0400
Ed
I don't have any "-t mangle" rules. Do you agree
that if I make default DROP policy for mangle table
that nothing will get thru???
The reason you can do:
> "$IPTABLES" -t nat -P PREROUTING DROP
> "$IPTABLES" -t nat -P POSTROUTING DROP
is because you have NAT rules that can get thru right?
Chris
>
>
> -----Original Message-----
> From: netfilter-admin@lists.samba.org
> [mailto:netfilter-admin@lists.samba.org] On Behalf Of Christian Seberino
> Sent: Monday, June 24, 2002 2:45 PM
> To: netfilter@lists.samba.org
> Subject: Default DROP policy for mangle and nat in iptables
> necessary/wise?
>
> Linux Firewalls book assigns a default drop policy
> to mangle and nat tables.
>
> I could not get DROP policy to work on these
> tables and I am skeptical this serves any useful
> purpose anyway since packets must all traverse
> filter table anyway.
>
> Is the author of Linux Firewalls on drugs or is
> this really useful somehow?? (assuming you can
> get it to work)
>
> Chris
>
> --
> _______________________________________
>
> Dr. Christian Seberino
> SPAWAR Systems Center San Diego
> Code 2363
> 53560 Hull Street
> San Diego, CA 92152-5001
> U.S.A.
>
> Phone: (619) 553-7940
> Fax: (619) 553-2836
> Email: seberino@spawar.navy.mil
> _______________________________________
>
--
_______________________________________
Dr. Christian Seberino
SPAWAR Systems Center San Diego
Code 2363
53560 Hull Street
San Diego, CA 92152-5001
U.S.A.
Phone: (619) 553-7940
Fax: (619) 553-2836
Email: seberino@spawar.navy.mil
_______________________________________
next prev parent reply other threads:[~2002-06-24 23:36 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-24 18:41 iptables -F & iptables -X good enough *for all* tables/chains? Christian Seberino
2002-06-24 18:45 ` Default DROP policy for mangle and nat in iptables necessary/wise? Christian Seberino
2002-06-24 19:02 ` Ed Street
2002-06-24 23:36 ` Christian Seberino [this message]
2002-06-25 0:11 ` Ramin Alidousti
2002-06-24 18:47 ` iptables -F & iptables -X good enough *for all* tables/chains? Ed Street
2002-06-24 19:57 ` Christian Seberino
2002-06-24 20:27 ` Ramin Alidousti
2002-06-24 20:34 ` Antony Stone
2002-06-24 21:20 ` Patrick Schaaf
2002-06-24 21:19 ` Ramin Alidousti
2002-06-25 6:04 ` Patrick Schaaf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20020624163650.A5016@spawar.navy.mil \
--to=seberino@spawar.navy.mil \
--cc=blacknet@simplyaquatics.com \
--cc=netfilter@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox