When running service iptables status on 2 CentOS server,

  • one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT
  • another server has policy DROP in Chain INPUT and Chain FORWARD; while policy ACCEPT in Chain OUTPUT

What the meaning of policy ACCEPT and policy DROP?

...and how to change from policy ACCEPT to policy DROP and from policy DROP to policy ACCEPT?


Accept means that the default policy for that chain, if there are no matching rules, is to allow the traffic.

Drop does the opposite.

The following rule will chance the policy for inbound traffic to drop

iptables --policy INPUT DROP

the manpage for iptables should be able to give you the rest of the info you would need to make other policy changes as necessary.

  • 8
    This may well not need saying but it is unwise to do the above on a server to which you are remotely logged in! – MadHatter Oct 11 '10 at 14:30
  • 4
    Right! Make yourself an exception for port 22 in the input chain first! – MDMarra Oct 11 '10 at 23:56

The policy defines the target for packets that get to the end of the chain.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.