Re: Verify rules

[Mart Frauenlob <mart.frauenlob@chello.at>]

netfilter-owner@vger.kernel.org wrote:
> That was it - works perfectly.  Now I have a base-line and can start
> tweeking and logging from there.  I will do as others have suggested, and
> either only allow SSH from one IP address or range, OR use the pubkey
> suggestion.
>
>
>  > -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
>   

Also think of maybe not allowing all icmp types. Some you might not 
want, as redirects for example.
suggestion:

iptables -N icmp_input
-A icmp_input -p icmp --icmp-type pong -m state --state ESTABLISHED -j 
ACCEPT
-A icmp_input -p icmp --icmp-type destination-unreachable -m state 
--state RELATED -j ACCEPT

... also problem describing, but should not break anything if not 
allowed (AFAIK...): source-quench, time-exceeded, parameter-problem - 
accept in related state also...
-A icmp_input -p icmp -j DROP
-A INPUT -p icmp -j icmp_input

greets

Mart