Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is dropping all FORWARD packets bad? What are they used for? Why would I want to block them or keep them open?

(I fully understand INPUT and OUTPUT)

share|improve this question
up vote 2 down vote accepted

Is your machine a router? Is it expected to do something with packets that it receives that are not destined for your machine?

You can safely drop packets if you are not expected to forward them, though it's probably a sign of a misconfigured network if you are receiving them.

share|improve this answer
Not a router. Just a web server – Luke Sep 21 '11 at 20:03
In that case, you shouldn't expect to see any packets on the FORWARD chain (try -j LOG if you want to be sure you are getting one), and can DROP if you wish. – crb Sep 21 '11 at 20:06

The FORWARD chain is used to manage packets that are being routed through the machine. If the machine is a router then dropping all packets in the FORWARD chain would be bad. If it's not a router then you can drop packets in the FORWARD chain (if they ever get there).

share|improve this answer
Nitpick/help for better understanding: FORWARD is a default chain, not a table. – crb Sep 21 '11 at 20:04
You're right - thanks. – Iain Sep 21 '11 at 20:08
+1 for having written 'Your' and then edited it to 'You're'. Cheekily, the inbox shows the initial comment. Sticklers unite :) – crb Sep 21 '11 at 20:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.