Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does “all packets that fall through to the default rule should be dropped” mean that my iptables rule should drop everything at the start, like this?

# Set the default policy to drop
$IPT --policy INPUT DROP

Or does it mean something else?

share|improve this question
up vote 1 down vote accepted

Yes, that's exactly what it means (and doesn't mean anything else).

Obviously it's a policy, and you can set your own depending on your needs and who your expected targets are. A DROP policy will show up as "filtered" when you scan the port with nmap, whereas a REJECT policy will show "closed"---this is because REJECT sends an ICMP unreachable message back, letting the person connecting know that there is no service listening on that port ("Connection Refused" is the typical user message).

share|improve this answer

It means that if you don't have a rule in your configuration that specifically allows a packet through then it should be dropped. Basically "Deny everything unless I specifically allow it".

I'm not an IPTables wiz, though, but basically you configure IP Tables to allow only what you want through and drop the rest.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.