Re: why is DENY not enough?
On Tue, Jul 20, 2004 at 01:22:41PM -0400, Steve Melo wrote:
> I'm sure that my question has a simple answer, but only recently have I
> begun to play with iptables. Can anyone please describe why it is necessary
> to specifically block each known attack. From what I have read a default
> INPUT policy of DENY should drop anything that was not specifically allowed.
> Almost all the firewall scripts I have seen so far include these extra
> rules, but I can't wrap my head around it.
The only reason to block specific attacks is to use logging chains.
Otherwise if the default policy is 'DENY' everything is denied that is
not explicitly allowed.
Christoph
--
~
~
".signature" [Modified] 3 lines --100%-- 3,41 All
Reply to: