Linux firewall configuration

From: Daniel Camps (danicamps81_at_yahoo.com)
Date: 11/30/04 

Date: 30 Nov 2004 10:17:41 -0800

Some questions about the default firewall configuration. The rules are
the following:

Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp
dpt:5353
ACCEPT udp -- anywhere anywhere udp
dpt:ipp
ACCEPT all -- anywhere anywhere state
RELATED,ESTABLISHED
REJECT all -- anywhere anywhere
reject-with icmp-host-prohibited

I basically don't understand the first rule in the RH-Firewall-1-INPUT
chain. It says "ACCEPT everything", then all the packets should match
that rule and stop the checking, isn't it?
And I don't understand either the one with the "state
RELATED,ESTABLISHED", what does it mean?

I would like to configure some rules to permit the MSN messenger and
emule services, does anyone know the ports and protocols that use
these services ?

Thanks a lot!

Relevant Pages

  • Re: iptables problem
    ... Chain INPUT (policy DROP) ... Say I have a server that runs services for web, mail, domain, time and is also a gateway (I will use masquerading for the last although you can use plain NAT). ... $ipt -F OUTPUT ...
    (RedHat)
  • ACK in TCP connectin setup being lost (Re: multiple interfaces to Internet issue)
    ... Examing the output of tcpdump a bit more closely, ... Chain POSTROUTING (policy ACCEPT) ... 63.250.109.128/29 dev eth1 proto kernel scope link src ...
    (comp.os.linux.networking)
  • Re: 2.6.18 forcedeth GSO panic on send
    ... I run tcpserver ... Chain INPUT (policy ACCEPT 20 packets, ...
    (Linux-Kernel)
  • Re: cant send or recive any emails
    ... and i really approcitiate that and i want to tell you something i am trying to be a powerful administrator so i get some mistakes please forgive me and help me to get the right configurations ... by the was what is the wrong in the forward chain? ... this should be ok if you'd have DROP policy on the INPUT chain but as ... All this is useless given the fact that you have ACCEPT policy. ...
    (RedHat)
  • Re: failing to share internet access between two PCs installed with Debian 3.1
    ... >> successfully and computer B was also able to share internet from ... I did not intentionally install firewall program for both computer or ... Chain FORWARD (policy DROP) ...
    (Debian-User)