Re: comments about local loopback interface rule granularity
|[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]|
Hi, 2012-03-13 15:28 keltezéssel, paddy joesoap írta:
I often see the following: iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT where a default DROP policy is applied to both INPUT and OUTPUT chains.
Just a side note. I always use these rules because:- I just enable something and deny everything else... (ACCEPT the specified and DROP as the policy). - I want my local services run "as fas as they can"... (I use the rules above as the first rule in the chain. Be aware that you can use the rules above in the raw, mangle and filter tables too..)
- I do not think that there is anything filterable on the "lo" interface. Swifty -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html