-1

In my iptables rules, I want to accept only lo but drop every other interface. but when I execute this command : -A INPUT -i lo -j ACCEPT

it is not specifying interface lo but it is accepting all interfaces. Any suggestion ?

is ignoring the interface and

# iptables --flush
# iptables-restore /tmp/h 
# iptables --list
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         

Chain bad_packets (0 references)
target     prot opt source               destination         

Chain bad_tcp_packets (0 references)
target     prot opt source               destination         

Chain icmp_packets (0 references)
target     prot opt source               destination         

Chain tcp_inbound (0 references)
target     prot opt source               destination         

Chain tcp_outbound (0 references)
target     prot opt source               destination         

Chain udp_inbound (0 references)
target     prot opt source               destination         

Chain udp_outbound (0 references)
target     prot opt source               destination         
# cat /tmp/h 
# Generated by iptables-save v1.4.18 on Thu Jan  1 08:47:28 1970
*filter
:INPUT DROP [53:20507]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:bad_packets - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-A INPUT -i lo -j ACCEPT
COMMIT
# Completed on Thu Jan  1 08:47:28 1970

--- on another note : flush is not changing the default policy

# iptables --flush
# iptables --list
Chain INPUT (policy DROP)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
1
  • 5
    Use the -v option when listing your firewall rules. Sep 29 '14 at 18:10
2

Use something like iptables -nvL to include interface name.

5
  • 'Chain INPUT (policy DROP) ' does that mean it drops all packets ? It is not dropping for me. Iam able to telnet into the box that has this rule.
    – resultsway
    Sep 29 '14 at 20:23
  • That could be because traffic goes through the FORWARD chain or INPUT chain has an ACCEPT rule.
    – Glueon
    Sep 29 '14 at 23:52
  • but you can see from my iptables --list the policy is DROP for both ? is it a bug in my platform ( mine is an embedded linux soc).
    – resultsway
    Sep 30 '14 at 15:32
  • also, iptables --flush is not changing the default policy from DROP to Accept
    – resultsway
    Sep 30 '14 at 15:57
  • It isn't supposed to; --flush deletes all the rules in a chain, it has nothing to do with policy.
    – MadHatter
    Aug 17 '15 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.