Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains.

I did not run iptables-save at any time.

After do this, I still had good access, but noticed that one of the rules wasn't right, so I decided to flush the rules immediately to avoid interrupting the users.

When I did this using iptables -F I was immediately denied access to the server (along with the rest of the world). So much for not wanting to interrupt the users!

Is it possible that the rules were flushed but the default policies were left as DROP?

What went wrong and what should I have done?

share|improve this question
1  
This isn't a security question, so I've VtC'ed it as off topic. A mod will shift it over to SuperUser if it is deemed appropriate. –  Polynomial Sep 11 '13 at 14:31
    
Really? I've never heard of iptables being used for anything other than security. Don't worry, I'm out of here. I won't back. –  Peter Snow Sep 11 '13 at 14:47
2  
Hi @PeterSnow, the subtle distinction here is that your question is about how iptables works, not the security of iptables or a particular configuration of iptables. But don't worry, no one is angry at you for not knowing this. We have the capability to migrate questions for a reason. Feel free to drop into chat if you want to check whether something would be on-topic or not. –  Ladadadada Sep 11 '13 at 14:58
add comment

closed as off-topic by Polynomial, TildalWave, Terry Chia, Manishearth, Xander Sep 11 '13 at 15:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – Polynomial, TildalWave, Manishearth
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 5 down vote accepted

iptables -F does not change the default policy. So when you set it to DROP and do a flush afterwards, it stays on DROP. I use the following commands to flush the tables

iptables -P INPUT   ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT  ACCEPT
iptables -F
iptables -X

This changes the default policies to ACCEPT for all filter chains, flushes the rules and removes all custom chains.

share|improve this answer
    
I always thought '-F' was my friend! Now I know better. I will put your snippet in an aliases script for emergencies! –  Peter Snow Sep 11 '13 at 14:54
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.