Home / server / Questions / 1018666
Accepted
Johnny Utahh
Asked: 2020-05-26 12:25:06 +0800 CST

iptables: employ DROP or REJECT rules in non-'filters' tables, namely the NAT table?

  • 772

For an iptables(8) firewall that is otherwise "properly locked down" in the filter table, is there any use to employ DROP, REJECT or similar, terminating, "blocking or disabling" rules in non-filters tables, namely the NAT table (or the mangle, raw, or security tables for that matter)?

We specifically want to close any, potential "holes" in our firewall.

NAT's POSTROUTING chain does not accept a DROP or REJECT target on at least one of out team's systems:

$ iptables -t nat -P POSTROUTING DROP
iptables v1.6.1:
The "nat" table is not intended for filtering, the use of DROP is therefore inhibited.


Try `iptables -h' or 'iptables --help' for more information.
$
$ iptables -t nat -P POSTROUTING REJECT
iptables: Bad policy name. Run `dmesg' for more information.
$
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:    18.04
Codename:   bionic
$
firewall nat iptables linux-networking rules

1 Answers

  1. Best Answer

    Short answer: no.

    Excerpt from reddit:

    "Packets can't skip the filter table, so dropping packets from an additional table doesn't buy you any additional security [...]"

    • 0