1

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains.

I did not run iptables-save at any time.

After do this, I still had good access, but noticed that one of the rules wasn't right, so I decided to flush the rules immediately to avoid interrupting the users.

When I did this using iptables -F I was immediately denied access to the server (along with the rest of the world). So much for not wanting to interrupt the users!

Is it possible that the rules were flushed but the default policies were left as DROP?

What went wrong and what should I have done?

3
  • 1
    This isn't a security question, so I've VtC'ed it as off topic. A mod will shift it over to SuperUser if it is deemed appropriate.
    – Polynomial
    Commented Sep 11, 2013 at 14:31
  • Really? I've never heard of iptables being used for anything other than security. Don't worry, I'm out of here. I won't back. Commented Sep 11, 2013 at 14:47
  • 2
    Hi @PeterSnow, the subtle distinction here is that your question is about how iptables works, not the security of iptables or a particular configuration of iptables. But don't worry, no one is angry at you for not knowing this. We have the capability to migrate questions for a reason. Feel free to drop into chat if you want to check whether something would be on-topic or not.
    – Ladadadada
    Commented Sep 11, 2013 at 14:58

1 Answer 1

10

iptables -F does not change the default policy. So when you set it to DROP and do a flush afterwards, it stays on DROP. I use the following commands to flush the tables

iptables -P INPUT   ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT  ACCEPT
iptables -F
iptables -X

This changes the default policies to ACCEPT for all filter chains, flushes the rules and removes all custom chains.

1
  • 1
    I always thought '-F' was my friend! Now I know better. I will put your snippet in an aliases script for emergencies! Commented Sep 11, 2013 at 14:54

Not the answer you're looking for? Browse other questions tagged .