A simple question

Hi,

In almost all IP Tables articles I've found that the default policy of all tables (INPUT,OUTPUT,FORWARD) set to DROP. I can understand it as far as INPUT and FORWARD tables are concerned, but I do not understand why should we set the default policy of OUTPUT chain to DROP. OUTPUT chain is responsible for packets originating from the firewall itself. Whay should we DROP it?

Thanks,
Sudheer

In almost all IP Tables articles I've found that the default policy of all tables (INPUT,OUTPUT,FORWARD) set to DROP. I can understand it as far as INPUT and FORWARD tables are concerned, but I do not understand why should we set the default policy of OUTPUT chain to DROP. OUTPUT chain is responsible for packets originating from the firewall itself. Whay should we DROP it?

Thanks,
Sudheer

What you say is indeed correct. Most of the articles on the subject do recommend a default DROP on all three tables. However, I personally do set my OUTPUT default to ACCEPT, while my FORWARD and INPUT are definitely set to DROP. As you might expect, it is quite easy to DOS the firewall itself when OUTPUT is set to DROP. And that is not a real good idea. However, having said that, close scrutiny must be paid to what you allow out of the firewall and the necessary rules must be in place.

Please elaborate - why is it easy to DOS the firewall if the output policy is DROP? You don't mean icmp/source-quench not getting delivered or something?

...which is why I personally use DROP as default policy for all chains and explicitly allow everything I think necessary :-)

The only exception is in the mangle table, where I use ACCEPT policies and just filter out the obvious spoofs, unclean frames etc.

Greetings,
Torsten

Hi,
As far as my knowledge this is done so that the local processes on the firewall machine itself cannot communicate with the outside world. Mostly firewalls are set for FORWARDing so from security point of view its better we set the OUTPUT chain to DROP.
But its again your choice waht you want to ACCEPT or DROP.

Sudheer,

I like to block all outgoing traffic in case that someone can take control either from my firewall system or any other system in my network.

The firewall should be the most secure system in your network; however, like any other system, it is still vulnerable to bugs and exploits.

If the firewall allows everything out, your system can turn out to be the one used to attack other systems. It might bee too paranoid, but I like to protect other people from having my systems attacking theirs.

Also, if you don't have a good system security policy, you might not realize that your system was taken over until the gentleman with the nice black suits
knock at your door .... =)

-- Just my two cents! maybe even less!

This email message has been scanned for viruses.