19.4. Changing a Chain's Default Action

Packets that do not match any rule in a chain will be processed using the default action, which is usually to accept the packet. On the module's main page, the default action for each chain is shown next to the Set default action to button. To change it, the steps to follow are:

1.
Select the new action from the menu next to the Set default action to button. Only the Accept, Drop, Userspace, and Exit chain actions are available—see Section 19.3 “Allowing and Denying Network Traffic” for their meanings. Typically, only Allow and Drop make sense as default actions.

2.
Click the Set default action to button to save the new default.

3.
If changing to Drop, add any additional firewall rules needed so that your system can still access other servers and supply important services.

4.
When done, click the Apply Configuration button to make the new default active.

Just changing the default action to Drop for incoming packets is an easy way to totally cut your system off from the network, and possibly make it unusable. Before you do so, make sure you allow at least the following kinds of traffic:

  • All established connections Create an Allow rule with the Connection state set to Equals and Existing connection chosen.

  • Connections related to those that are established, such as FTP data connections Create an Allow rule with the Connection state set to Equals and Related connection chosen.

  • All traffic on the loopback interface Create an Allow rule with Incoming interface set to Equals and lo chosen.

  • Traffic from your system to itself on its primary network interfaces For each interface create an Allow rule with both the Source address or network and Destination address or network set to the interface IP address.

  • Safe ICMP types Create four Allow rules with the ICMP packet type set to Equals and echo-reply, destination-unreachable, source-quench, and time-exceeded chosen.

Changing the default action for forwarded packets to Drop will not cause as many problems—it will just be the equivalent of turning off forwarding altogether. Changing the default action for outgoing packets to Drop is a bad idea as it will cut off all network access, and probably makes very little sense in most cases.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.216.21.138