<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><b>Typically I would configure iptables to have a policy of DROP to prevent all access and then to allow specific port to go through:</b><div><br><div><div># iptables -L -n</div><div>Chain INPUT (policy DROP)</div><div>target prot opt source destination </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 </div><div>REJECT all -- 0.0.0.0/0 127.0.0.0/8 reject-with icmp-port-unreachable</div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED</div><div>ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 </div><div>….</div><div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080</div><div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22</div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited</div><div><br></div><div>Chain FORWARD (policy DROP)</div><div>target prot opt source destination </div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited</div><div><br></div><div>Chain OUTPUT (policy DROP)</div><div>target prot opt source destination </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 </div></div></div><div><br></div><div><b>However recently I encounter a system which has its policy set to ACCEPT</b></div><div><br></div><div><div># iptables -L -n</div><div>Chain INPUT (policy ACCEPT)</div><div>target prot opt source destination </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED </div><div>ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 </div><div>…</div><div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 </div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited </div><div><br></div><div>Chain FORWARD (policy ACCEPT)</div><div>target prot opt source destination </div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited </div><div><br></div><div>Chain OUTPUT (policy ACCEPT)</div><div>target prot opt source destination </div><div><br></div></div><div><br></div><div><b>I was wondering if this system is secure at all and just badly misconfigured. For some reason it seems to kind of work as traffic is being blocked. Maybe I just don't understand this properly. Any pointers in the right direction would really help me out.</b></div><div><b><br></b></div><div><b>Thanks in advance</b></div><div><b>Alex</b></div></body></html>