Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When running service iptables status on 2 CentOS server,

  • one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT
  • another server has policy DROP in Chain INPUT and Chain FORWARD; while policy ACCEPT in Chain OUTPUT

What the meaning of policy ACCEPT and policy DROP?

...and how to change from policy ACCEPT to policy DROP and from policy DROP to policy ACCEPT?

share|improve this question

Accept means that the default policy for that chain, if there are no matching rules, is to allow the traffic.

Drop does the opposite.

The following rule will chance the policy for inbound traffic to drop

iptables --policy INPUT DROP

the manpage for iptables should be able to give you the rest of the info you would need to make other policy changes as necessary.

share|improve this answer
This may well not need saying but it is unwise to do the above on a server to which you are remotely logged in! – MadHatter Oct 11 '10 at 14:30
Right! Make yourself an exception for port 22 in the input chain first! – MDMarra Oct 11 '10 at 23:56

The policy defines the target for packets that get to the end of the chain.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.