5

Is dropping all FORWARD packets bad? What are they used for? Why would I want to block them or keep them open?

(I fully understand INPUT and OUTPUT)

2 Answers 2

3

Is your machine a router? Is it expected to do something with packets that it receives that are not destined for your machine?

You can safely drop packets if you are not expected to forward them, though it's probably a sign of a misconfigured network if you are receiving them.

2
  • Not a router. Just a web server
    – Luke
    Sep 21, 2011 at 20:03
  • 1
    In that case, you shouldn't expect to see any packets on the FORWARD chain (try -j LOG if you want to be sure you are getting one), and can DROP if you wish.
    – crb
    Sep 21, 2011 at 20:06
1

The FORWARD chain is used to manage packets that are being routed through the machine. If the machine is a router then dropping all packets in the FORWARD chain would be bad. If it's not a router then you can drop packets in the FORWARD chain (if they ever get there).

2
  • Nitpick/help for better understanding: FORWARD is a default chain, not a table.
    – crb
    Sep 21, 2011 at 20:04
  • +1 for having written 'Your' and then edited it to 'You're'. Cheekily, the inbox shows the initial comment. Sticklers unite :)
    – crb
    Sep 21, 2011 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .