iptables, default policy vs rules

Question

Is there any difference in dropping not-matched packets with default policy vs -j DROP on the end?

Like:

iptables -P INPUT DROP
iptables -A INPUT --dport 80 -j ACCEPT

vs

iptables -A INPUT --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

The reason why I care is because I can't create chain with log and assing it as default policy so I would need to use the second example.

In general, anything. When I am debuging iptables its hide&seek when i don't know where or why it was dropped. — someone, Sep 24 '12 at 10:07

score 6 · Answer 1 · answered Sep 23 '12 at 23:45

Yes. If you use a policy of DROP, and then connect over SSH and flush the table (iptables -F), you lock yourself out as the default policy is not flushed.

I have done this on a remote system. It hurt.

(Other lesson learnt, if you want to get rid of the firewall for a while, use service iptables stop, not iptables -F + service iptables reload)

A default policy is likely more secure from being easier to manage though. You can't forget to add it to the end.

score 6 · Accepted Answer · answered Sep 24 '12 at 00:02

From a technical viewpoint, No. The packet gets dropped either way.

But Sirex is quite correct in that it can be a bit painful if you forget something important when switching table default rules.

After spending some time with IPTables, you'll likely find a preference and build your systems around that in your environment.

score 3 · Answer 3 · answered Dec 20 '13 at 12:23

Maybe one other thing to this topic for those who need this bit of information just like me a few hours ago.

The latter way:

iptables -A INPUT --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

doesn't let you append a rule later (because the appended rule will appear after the universal drop rule and will therefore have no effect), you'll have to insert the rule with explicit statement of the desired position:

iptables -I INPUT 1 --dport 8080 -j ACCEPT

instead of

iptables -A INPUT --dport 80 -j ACCEPT

Depending on your needs it may help the security a tiny bit by requiring you or whatever later adds the rule to really go through the existing rules an not just append it as usual.

This knowledhe I have earned yesterday while checking for twenty minutes why my newly installed service won't respond even though everything is up and running.

score 1 · Answer 4 · answered Sep 24 '12 at 02:59

Default policies are quite limited, but make a good backstop to ensure un-handled packets get dealt with in the proper manner.

If you need (want) to log those packets you need a final rule. This can be a chain which logs and applies the policy. You could also just log and let the policy handle it.

Consider these approaches to policy, and the final policy rule.

use and accept policy and override with the desired policy as the final rule. This can protect you when you a managing a host at a remote location. If you drop your rules, you are only left with your secondary line of defense such as hosts.allow. If you drop your final rule you end up in a mostly open or fully open configuration.
set the desired policy and backstop it with a final policy rule. This can be more secure when you have physical, or console access to a host. If you drop your rules, you loose access to all services unless the policy is ACCEPT. If you drop your final rule, you are still protected.

iptables, default policy vs rules

4 Answers4