Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm securing my debian with iptables. I done that for allow ssh, http and https:

# history | grep iptable
18  /sbin/iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
22  /sbin/iptables -I INPUT 2 -i lo -j ACCEPT
23  /sbin/iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
24  /sbin/iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
25  /sbin/iptables -A INPUT -p tcp -i eth0 --dport 443 -j ACCEPT
26  /sbin/iptables -P INPUT DROP

18: connextions already etablshed 22: localhost 23, 24, 25: ssh, http, https 26: block other

My rules:

# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

The line:

ACCEPT     all  --  anywhere             anywhere

is scaring me: this rule allow all traffic ?

Edit:

# iptables -L -v -n
Chain INPUT (policy DROP 1352 packets, 99220 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  275 21348 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state ESTABLISHED
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 67 packets, 9852 bytes)
 pkts bytes target     prot opt in     out     source               destination
share|improve this question
    
Can you post the output for iptables -L -v -n? –  Bart De Vos Oct 24 '13 at 10:57

2 Answers 2

up vote 2 down vote accepted

The line you are referring to allows all traffic on the lo interface (localhost). It is generally harmless, and removing it can cause problems.

The interface columns are only visible after you add -v to your iptables command.

share|improve this answer

Yes, that line allows everything.

share|improve this answer
    
So i need to "delete it" for security ? –  bux Oct 24 '13 at 10:51
    
That would be smart, yes. There are some occasions when it's smart to just block certain types of traffic and then allow all the rest, but that's not really for security: for security you allow explicitly what you need to let trought and deny/drop everythint else. –  Sami Laine Oct 28 '13 at 6:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.