Basic iptables question

Using the "Security Level" tool in the System Settings menu in Redhat
9 to set security level to "High" sets the very first rule for the
iptables INPUT chain to:

target prot opt source destination
ACCEPT all -- anywhere anywhere

From what I understand of iptables, after the first match it quits
processing rules. Wouldn't this let ALL trafic through? Why would
any of the following REJECT rules that get set up be processed.

-David Yowell

In article <(E-Mail Removed)> ,
David Yowell wrote:
> target prot opt source destination
> ACCEPT all -- anywhere anywhere
>
> From what I understand of iptables, after the first match it quits
> processing rules. Wouldn't this let ALL trafic through? Why would
> any of the following REJECT rules that get set up be processed.

Your GUI is hiding details from you. You're looking at the useless
output of "iptables -L". Try "iptables -vnL" or "iptables-save" to see
more useful output.
--
/dev/rob0 - preferred_email=i$((28*28+28))@softhome.net
or put "not-spam" or "/dev/rob0" in Subject header to reply

David Yowell wrote:

> From what I understand of iptables, after the first match it quits
> processing rules. Wouldn't this let ALL trafic through? Why would
> any of the following REJECT rules that get set up be processed.
>

No. The default policy is to drop all. So if a specific match is not
found, the traffic will be dropped.

Imagine the following.

Allow green cars through
Allow blue cars through
Stop all cars.

A green car will match on the 1st rule and will be allowed to pass. A blue
car will not match the 1st rule, but it will match the 2nd and will pass A
red car will not match on the 1st or 2nd rule and will be blocked by the
3rd. In this example, you specify all the colours you want to pass. All
others are blocked.


--

Fundamentalism is fundamentally wrong.

To reply to this message, replace everything to the left of "@" with
james.knott.

> Your GUI is hiding details from you. You're looking at the useless
> output of "iptables -L". Try "iptables -vnL" or "iptables-save" to see
> more useful output.

Thank you! That clears up EVERYTHING.