RFC - sysadmin guidelines
Mike McGrath
mmcgrath at redhat.com
Sat Jan 17 17:43:55 UTC 2009
On Fri, 16 Jan 2009, Frank Chiulli wrote:
> Mike,
> First let me say that the examples are a great addition to the page.
>
> I was looking at the iptables sample configuration and had some
> questions. I compared your suggested configuration to my current
> configuration (Fedora 10). With the exception of the lines with
> '--tcp-flags' in your sample configuration, they're pretty close. I
> don't have those yet. The first three lines that start with '-A' in
> your sample are the same as mine except the order is different. Does
> the order make a difference?
>
> Here are the lines from my file:
> -A INPUT -m state --state ESTABLISHED,RELATED -j accept
> -A INPUT -p icmp -j ACCEPT
> -A INPUT -i lo -j ACCEPT
>
> Here are yours:
> -A INPUT -i lo -j ACCEPT
> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> -A INPUT -p icmp -j ACCEPT
>
The order isn't that important though I should really have
established,related come first. The main reason for this is because
IPTables runs like a list, any already approved content doesn't have to
get checked against much of the list but instead is automatically
approved.
This has security implications but for most setups its a good policy.
I'll actually move that up now and refresh that page soon.
-Mike
More information about the Fedora-infrastructure-list
mailing list