Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

OS Hardening Principles

|

81

the packet is copied to the local syslog facility but also continues its way down the

chain of filters; or the rule may transfer the packet to a different chain of filters (i.e., a

NAT chain or a custom chain).

If a packet is checked against all rules in a chain without being matched, the chain’s

default policy is applied. For INPUT, FORWARD, and OUTPUT, the default policy

is ACCEPT, unless you specify otherwise. I highly recommend that the default poli-

cies of all chains in any production system be set to DROP.

Using iptables

There are basically two ways to use iptables: to add, delete, and replace individual

netfilter rules and to list or manipulate one or more chains of rules. Since netfilter

has no built-in means of recording or retaining rules between system boots, rules are

typically added via startup script. Like route, iptables is a command you shouldn’t

have to invoke interactively too often outside of testing or troubleshooting scenarios.

To view all rules presently loaded into netfilter, we use this command:

iptables --list

We can also specify a single chain to view, rather than viewing all chains at once:

iptables --list INPUT

To see numbered rules (by default, they’re listed without numbers), use the --line-

numbers

option:

iptables --line-numbers ...