From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1LyWbu-0002gI-LF for garchives@archives.gentoo.org; Mon, 27 Apr 2009 19:35:26 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 83869E041F; Mon, 27 Apr 2009 19:35:25 +0000 (UTC) Received: from mail-qy0-f117.google.com (mail-qy0-f117.google.com [209.85.221.117]) by pigeon.gentoo.org (Postfix) with ESMTP id 5E48CE041F for ; Mon, 27 Apr 2009 19:35:25 +0000 (UTC) Received: by qyk15 with SMTP id 15so236474qyk.32 for ; Mon, 27 Apr 2009 12:35:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :organization:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=qjikGueyEEkaA7OxHCVvrEcUtI+nTAD0IL6WAMp2Qh8=; b=Hgillr9dhifPdwbFs5PQl859BRjpW/aJQdghq3Xwulthk2F3ce9N8F0BPt43Bn95HI tYy1dbjsiIXEFb7zncfw9BEbmgeIf/lDP8ZFxp0PMe4CRLxGMgiGzp43TjnqZcpcUeDT 5PfUAa9qnoCw02ZWZIgMWBQC5+8PWPd4awyZ4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:organization:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; b=SlEhvBO+N49jYTaIrKgop3xtV+ZXSB8f+zkVy4fhjOMIZoZEXOyYLXHZVmgULOFwLY 8gCJp/RGUeYemkE2Nav+zWvOq43OePPZxtEeHl/T+cI/FNyW/P82+hx33CUIxQOpz19L orhbsLw47HDnQ8K2iyOyJf00b7DCx2Vck0h5c= Received: by 10.229.84.72 with SMTP id i8mr3011746qcl.63.1240860925079; Mon, 27 Apr 2009 12:35:25 -0700 (PDT) Received: from ?10.0.0.57? ([208.58.149.18]) by mx.google.com with ESMTPS id 5sm958677ywl.32.2009.04.27.12.35.24 (version=SSLv3 cipher=RC4-MD5); Mon, 27 Apr 2009 12:35:24 -0700 (PDT) Message-ID: <49F608FA.7030007@gmail.com> Date: Mon, 27 Apr 2009 15:35:22 -0400 From: Eric Martin Organization: Snowbound Software User-Agent: Thunderbird 2.0.0.21 (X11/20090325) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Is this firewall safe? References: <93d30e950904240828t6e20bd22v2946d302c2cc5843@mail.gmail.com> <49F1EFF8.7060801@gmail.com> <93d30e950904241053x55b9f169x887296edc4a74830@mail.gmail.com> In-Reply-To: <93d30e950904241053x55b9f169x887296edc4a74830@mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Archives-Salt: 779d5f9d-4302-4ee2-9de5-515ca64cc750 X-Archives-Hash: 964c5322bac4e60d627633fb8ef70049 Marco wrote: > On Fri, Apr 24, 2009 at 4:59 PM, Eric Martin wrote: > >> Marco wrote: >> >>> Hi all, >>> >>> I set up my first firewall on my notebook (not running any services >>> reachable from outside) using iptables. Since I am new to the topic, >>> could you please verify if the output of 'iptables -L -v' is >>> considered to be a safe firewall? Thanks! >>> >>> Chain INPUT (policy DROP 0 packets, 0 bytes) >>> pkts bytes target prot opt in out source >>> destination >>> 0 0 ACCEPT all -- lo any anywhere >>> anywhere >>> 0 0 ACCEPT all -- eth0 any anywhere >>> anywhere state RELATED,ESTABLISHED >>> 0 0 REJECT tcp -- eth0 any anywhere >>> anywhere reject-with tcp-reset >>> 0 0 REJECT udp -- eth0 any anywhere >>> anywhere reject-with icmp-port-unreachable >>> 0 0 DROP udp -- eth0 any anywhere >>> anywhere udp spt:bootps >>> 0 0 LOG all -- eth0 any anywhere >>> anywhere LOG level warning prefix `INPUT ' >>> 1 79 ACCEPT all -- wlan0 any anywhere >>> anywhere state RELATED,ESTABLISHED >>> 0 0 REJECT tcp -- wlan0 any anywhere >>> anywhere reject-with tcp-reset >>> 0 0 REJECT udp -- wlan0 any anywhere >>> anywhere reject-with icmp-port-unreachable >>> 0 0 DROP udp -- wlan0 any anywhere >>> anywhere udp spt:bootps >>> 0 0 LOG all -- wlan0 any anywhere >>> anywhere LOG level warning prefix `INPUT ' >>> >>> Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) >>> pkts bytes target prot opt in out source >>> destination >>> 0 0 LOG all -- any any anywhere >>> anywhere LOG level warning prefix `FORWARD ' >>> 0 0 LOG all -- any any anywhere >>> anywhere LOG level warning prefix `FORWARD ' >>> >>> Chain OUTPUT (policy ACCEPT 5 packets, 1691 bytes) >>> pkts bytes target prot opt in out source >>> destination >>> 0 0 ACCEPT all -- any lo anywhere >>> anywhere >>> 0 0 LOG all -- any eth0 anywhere >>> anywhere LOG level warning prefix `OUTPUT ' >>> 1 52 LOG all -- any wlan0 anywhere >>> anywhere LOG level warning prefix `OUTPUT ' >>> >>> > > Sorry for the bad format. gmail decided to insert some sub ideal pagebreaks... > > Talking about the 1 log line at the bottom you mean I should configure > it to not specify an interface (eth0, wlan0)? > > Thanks! > > Yeah, not specifying an interface for the log rule to apply to will make it catch all interfaces (including lo but all traffic has already been approved ahead of time so it won't catch).