Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In many places and tutorials I see people add this line to their iptables:


And they do it only and only for "INPUT". What about OUTPUT and FORWARD?

  1. For OUTPUT: Is it due to the fact that normally everything goes out (OUTPUT) will be allowed? (-j ACCEPT)

  2. For FORWARD: they assume that their firewall machine is also FTP server too(!) otherwise if FTP machine in behind the firewall we need another rule for FORWARD too.

share|improve this question

Most firewall policies focus on restricting inbound traffic; they don't try to limit outbound traffic. That's why this is only applied to INPUT, not OUTPUT. There would be no point applying it to OUTPUT, if everything that goes out is allowed.

FORWARD is not relevant for endpoints. It is only relevant for a router that is forwarding traffic. Most firewall rulesets I see on the Internet are focused on a firewall for an end-user machine or server.

share|improve this answer
Thanks for your answer, yet I don't get the last part. Why not worrying too much about the forwarding path? It's the sole purpose of having a firewall: to control the forwarding path – shayan Feb 6 '12 at 12:19
When you use the forward chain, you are normally going from eth0 to eth1 or something to that affect. Having traffic go across multiple NICs. For your average servers or computers, they are the end point of the traffic. The server is either going to accept it or drop it. There is no need for it to forward it anywhere else. – Eric Feb 6 '12 at 19:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.