iptables, default policy vs rules

Question

Is there any difference in dropping not-matched packets with default policy vs -j DROP on the end?

Like:

iptables -P INPUT DROP
iptables -A INPUT --dport 80 -j ACCEPT

vs

iptables -A INPUT --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

The reason why I care is because I can't create chain with log and assing it as default policy so I would need to use the second example.

Answer 1

From a technical viewpoint, No. The packet gets dropped either way.

But Sirex is quite correct in that it can be a bit painful if you forget something important when switching table default rules.

After spending some time with IPTables, you'll likely find a preference and build your systems around that in your environment.

Answer 2

Yes. If you use a policy of DROP, and then connect over SSH and flush the table (iptables -F), you lock yourself out as the default policy is not flushed.

I have done this on a remote system. It hurt.

(Other lesson learnt, if you want to get rid of the firewall for a while, use service iptables stop, not iptables -F + service iptables reload)

A default policy is likely more secure from being easier to manage though. You can't forget to add it to the end.

Answer 3

Default policies are quite limited, but make a good backstop to ensure un-handled packets get dealt with in the proper manner.

If you need (want) to log those packets you need a final rule. This can be a chain which logs and applies the policy. You could also just log and let the policy handle it.

Consider these approaches to policy, and the final policy rule.

• use and accept policy and override with the desired policy as the final rule. This can protect you when you a managing a host at a remote location. If you drop your rules, you are only left with your secondary line of defense such as hosts.allow. If you drop your final rule you end up in a mostly open or fully open configuration.
• set the desired policy and backstop it with a final policy rule. This can be more secure when you have physical, or console access to a host. If you drop your rules, you loose access to all services unless the policy is ACCEPT. If you drop your final rule, you are still protected.