Home / server / Questions / 314086
Accepted
Luke
Asked: 2011-09-22 11:56:29 +0800 CST

iptables -P FORWARD DROP, good or bad?

  • 772

Is dropping all FORWARD packets bad? What are they used for? Why would I want to block them or keep them open?

(I fully understand INPUT and OUTPUT)

iptables

2 Answers

  1. Best Answer

    Is your machine a router? Is it expected to do something with packets that it receives that are not destined for your machine?

    You can safely drop packets if you are not expected to forward them, though it's probably a sign of a misconfigured network if you are receiving them.

    • 3

  2. The FORWARD chain is used to manage packets that are being routed through the machine. If the machine is a router then dropping all packets in the FORWARD chain would be bad. If it's not a router then you can drop packets in the FORWARD chain (if they ever get there).

    • 1