Do I have any unneeded iptable rules?

Question

Can someone tell me, if I have rules that are not needed?

I am in particular unsure if

    $IPT -t nat -P PREROUTING ACCEPT                # is this required?
    $IPT -t nat -P INPUT ACCEPT                     # is this required?
    $IPT -t nat -P OUTPUT ACCEPT                    # is this required?

is needed.?

IPT='/sbin/iptables'

LAN_IP_NET="192.168.0.1/24"
WAN_IP="x.x.x.x"

LAN_NET="192.168.245.0/24"

CLIENT_NET1="192.168.245.128/25"  # 192.168.245.128 - 192.168.245.25
CLIENT_NET2="192.168.245.64/26"   # 192.168.245.64  - 192.168.245.12
CLIENT_NET3="192.168.245.32/27"   # 192.168.245.32  - 192.168.245.63
CLIENT_NET4="192.168.245.16/28"   # 192.168.245.16  - 192.168.245.31
CLIENT_NET5="192.168.245.8/29"    # 192.168.245.8   - 192.168.245.15

LAN_NIC="eth1"
WAN_NIC="eth0"

    # Flush everything
    $IPT -F
    $IPT -F -t nat
    $IPT -X
    $IPT -X -t nat


    # Enable packet forwarding
    echo 1 > /proc/sys/net/ipv4/ip_forward

    # Allow all outgoing
    $IPT -P OUTPUT ACCEPT
    $IPT -A OUTPUT -o lo -j ACCEPT

    # Filter rules
    $IPT -A INPUT -i lo -j ACCEPT
    $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Allow all traffic from LAN_NET on LAN_NIC
    $IPT -A INPUT -i $LAN_NIC -s $LAN_NET -j ACCEPT

    # Allow some services from the outside
    $IPT -A INPUT -i $WAN_NIC -p icmp --icmp-type echo-request -j ACCEPT
    $IPT -A INPUT -i $WAN_NIC -p tcp --dport ssh -j ACCEPT
    $IPT -A INPUT -i $WAN_NIC -p tcp --dport www -j ACCEPT

    $IPT -A INPUT -j REJECT



    # Masquerade 192.168.245.8 - 192.168.245.255
    $IPT -t nat -P PREROUTING ACCEPT                # is this required?
    $IPT -t nat -P INPUT ACCEPT                     # is this required?
    $IPT -t nat -P OUTPUT ACCEPT                    # is this required?

    $IPT -t nat -A POSTROUTING -s $CLIENT_NET1 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET2 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET3 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET4 -o $WAN_NIC -j MASQUERADE
    $IPT -t nat -A POSTROUTING -s $CLIENT_NET5 -o $WAN_NIC -j MASQUERADE


    $IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

    # Forward 192.168.245.8 - 192.168.245.255. The first 7 IPs are reserved for failover etc
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET1 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET2 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET3 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET4 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -i $LAN_NIC -o $WAN_NIC -s $CLIENT_NET5 -m state --state NEW -j ACCEPT
    $IPT -A FORWARD -j REJECT

Answer 1

Policy rules are unlike other rules, and all built-in chains have a policy. They are and implicit part of the chain and specify what to do if no rules in the chain match a packet. Setting the policy to a known value is a good practice.

You could try dropping the rules and seeing if the default policy is ACCEPT following a reboot. As long as the default policy remains ACCEPT, the commands are redundant. However, if someone changes the policy or the default policy changes, your firewall script will no longer do what you wish. Keep those rules even if it appears you don't need them.

Your best choice for a policy is to set it to whatever you want to happen to unmatched packets. For the default chains DROP or REJECT may be a better policy than ACCEPT. For the NAT chains, ACCEPT tends to be a good policy.

Answer 2

the -P rules are the "policy" rules. i.e: the default policy if none of the rules match. In your case they wont do anything because the last like is a reject all anyway, you could use a -P DROP and ditch that reject line also, however I do my firewall the same way you do currently because if you use a -P drop rule and then flush the table remotely using -F you still have the drop policy in place and it cuts out off your connection.