<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Thanks guys. Really helped me out with this one.<div><br></div><div><br><div><div>On 26/10/2012, at 1:42 PM, Alexander Hartner <<a href="mailto:alex@j2anywhere.com">alex@j2anywhere.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><b>Typically I would configure iptables to have a policy of DROP to prevent all access and then to allow specific port to go through:</b><div><br><div><div># iptables -L -n</div><div>Chain INPUT (policy DROP)</div><div>target prot opt source destination </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 </div><div>REJECT all -- 0.0.0.0/0 127.0.0.0/8 reject-with icmp-port-unreachable</div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED</div><div>ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 </div><div>….</div><div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080</div><div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22</div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited</div><div><br></div><div>Chain FORWARD (policy DROP)</div><div>target prot opt source destination </div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited</div><div><br></div><div>Chain OUTPUT (policy DROP)</div><div>target prot opt source destination </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 </div></div></div><div><br></div><div><b>However recently I encounter a system which has its policy set to ACCEPT</b></div><div><br></div><div><div># iptables -L -n</div><div>Chain INPUT (policy ACCEPT)</div><div>target prot opt source destination </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED </div><div>ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 </div><div>ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 </div><div>…</div><div>ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 </div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited </div><div><br></div><div>Chain FORWARD (policy ACCEPT)</div><div>target prot opt source destination </div><div>REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited </div><div><br></div><div>Chain OUTPUT (policy ACCEPT)</div><div>target prot opt source destination </div><div><br></div></div><div><br></div><div><b>I was wondering if this system is secure at all and just badly misconfigured. For some reason it seems to kind of work as traffic is being blocked. Maybe I just don't understand this properly. Any pointers in the right direction would really help me out.</b></div><div><b><br></b></div><div><b>Thanks in advance</b></div><div><b>Alex</b></div></div>_______________________________________________<br>PLUG discussion list: <a href="mailto:plug@plug.org.au">plug@plug.org.au</a><br><a href="http://lists.plug.org.au/mailman/listinfo/plug">http://lists.plug.org.au/mailman/listinfo/plug</a><br>Committee e-mail: committee@plug.org.au<br>PLUG Membership: http://www.plug.org.au/membership</blockquote></div><br></div></body></html>