[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Doubt about iptables rules.





Gawain Lynch wrote:

On Tue, 2006-05-30 at 23:22 -0300, Vinicius wrote:

Hello,

On the chain RH-Firewall-1-INPUT, what's the mean of the rules number 1
and 2, please?


[SNIP]

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere
2    ACCEPT     icmp --  anywhere             anywhere            icmp any
"


If you try "iptables -L -v" you will see that number 1 is to allow all
traffic on the loopback adapter (lo)
As for line number 2, this accepts *all* ICMP traffic.  Not ideal, just
the way it is  :-)




Yes.  Unfortunately, iptables -L doesn't show the interface, which is
really necessary to understand the rules.  The solution suggested by
the previous poster solves this.

I have concluded some time ago that "-L" without "-v" is useless.
Unfortunately, adding "-v" also produces a very wide listing by
including the individual rule packet counts, which I don't need to
understand the rules.

Obviously, an enhancement might be to add the interface to the
"-L" output itself.  Unfortunately, the output of commands like this
is often processed by other programs and scripts, so changing the
output has to be carefully weighed against the breaking of all
those processing programs.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]