Re: How to work with my iptables script

[Daniel Pittman <daniel@rimspace.net>]

On 3 Sep 2004, Raffaele D'Elia wrote:
> Tom Geissler wrote:
>> * Ansgar -59cobalt- Wiechers <lists@planetcobalt.net> [25-08-04 12:40]:
>>
>>> On 2004-08-25 Jacob Friis Larsen wrote:
>>>
>>>> ...
>>>> # STATE RELATED for router
>>>> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>>>
>>> I would rather add a rule to accept ESTABLISHED,RELATED traffic in the
>>> OUTPUT chain and set the default OUTPUT policy to DROP.
>>>
>>> You should also allow ICMP (at least some types) and REJECT TCP traffic
>>> (with RST) rather than just DROP it. IMHO.
>>
>> Allow ICMP-Types 0, 3, 4, 8, 11 ,12 and REJECT also UDP traffic with
>> 'port-unreachable'
>
> What about icmp type 12? Actually I drop it; but I'm not sure about
> it.

Type 12 is 'Parameter Problems'; while not common in the wild it does
indicate a serious issue and should be allowed through to your system.

         Daniel
-- 
Bad science and bad religion simply swap roles,
the former proclaiming Truth, the latter worshiping Doubt.
        -- Jeffrey Satinover