Hoping someone can clear this up for me. I'm on RHEL7.1 and I noticed that in iptables I have a rule that allows anything incoming. I ran this command to get the line numbers and interfaces just to make sure:

iptables --line-numbers -L -v --verbose

and this is the output. (first line only)

1      30M 2931M ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED

This is from the input chain. Now here is the last line of the input chain:

42    243K   22M DROP       all  --  any    any     anywhere             anywhere

Now, I also have many rules in the input chain in between. But I do not understand why I would even need these with the "any any" rule at the very top. Doesn't this defeat the purpose of having iptables running? Do I have a mis-configured firewall here?

  • Read the first rule in its entirety. – Michael Hampton Oct 23 '15 at 19:44
  • @MIchael is that rule actually needed? What would happen if I were to remove it and restart iptables? I am guessing if its related to an exsiting connection whatever that connection was would be dropped? – user53029 Oct 23 '15 at 20:12

The first rule just accept RELATED and ESTABLISHED connections, not NEW ones. You have this rule probably because you're blocking everything and just allowing some services, like HTTP, DNS, etc. At the end, everything that doesn't match any previous rule will be dropped.

  • Ok, that makes sense. So I see that I have packets associated with this rule. How do I track down what connection or process they belong to? – user53029 Oct 23 '15 at 19:59
  • @user53029 They belong to every connection ever made by the machine, in both directions. – Michael Hampton Oct 23 '15 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.