5

In many places and tutorials I see people add this line to their iptables:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

And they do it only and only for "INPUT". What about OUTPUT and FORWARD?

  1. For OUTPUT: Is it due to the fact that normally everything goes out (OUTPUT) will be allowed? (-j ACCEPT)

  2. For FORWARD: they assume that their firewall machine is also FTP server too(!) otherwise if FTP machine in behind the firewall we need another rule for FORWARD too.

Improve this question

1 Answer 1

Reset to default
3

Most firewall policies focus on restricting inbound traffic; they don't try to limit outbound traffic. That's why this is only applied to INPUT, not OUTPUT. There would be no point applying it to OUTPUT, if everything that goes out is allowed.

FORWARD is not relevant for endpoints. It is only relevant for a router that is forwarding traffic. Most firewall rulesets I see on the Internet are focused on a firewall for an end-user machine or server.

Improve this answer
2
  • Thanks for your answer, yet I don't get the last part. Why not worrying too much about the forwarding path? It's the sole purpose of having a firewall: to control the forwarding path
    – shayan
    Feb 6, 2012 at 12:19
  • 1
    When you use the forward chain, you are normally going from eth0 to eth1 or something to that affect. Having traffic go across multiple NICs. For your average servers or computers, they are the end point of the traffic. The server is either going to accept it or drop it. There is no need for it to forward it anywhere else.
    – Eric
    Feb 6, 2012 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.