Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is dropping all FORWARD packets bad? What are they used for? Why would I want to block them or keep them open?

(I fully understand INPUT and OUTPUT)

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Is your machine a router? Is it expected to do something with packets that it receives that are not destined for your machine?

You can safely drop packets if you are not expected to forward them, though it's probably a sign of a misconfigured network if you are receiving them.

share|improve this answer
    
Not a router. Just a web server –  Luke Sep 21 '11 at 20:03
1  
In that case, you shouldn't expect to see any packets on the FORWARD chain (try -j LOG if you want to be sure you are getting one), and can DROP if you wish. –  crb Sep 21 '11 at 20:06

The FORWARD chain is used to manage packets that are being routed through the machine. If the machine is a router then dropping all packets in the FORWARD chain would be bad. If it's not a router then you can drop packets in the FORWARD chain (if they ever get there).

share|improve this answer
    
Nitpick/help for better understanding: FORWARD is a default chain, not a table. –  crb Sep 21 '11 at 20:04
1  
You're right - thanks. –  Iain Sep 21 '11 at 20:08
    
+1 for having written 'Your' and then edited it to 'You're'. Cheekily, the inbox shows the initial comment. Sticklers unite :) –  crb Sep 21 '11 at 20:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.