Re: why is DENY not enough?
On Tue, Jul 20, 2004 at 01:22:41PM -0400, Steve Melo wrote:
>
> I'm sure that my question has a simple answer, but only recently have
> I begun to play with iptables. Can anyone please describe why it is
> necessary to specifically block each known attack. From what I have
> read a default INPUT policy of DENY should drop anything that was not
> specifically allowed. Almost all the firewall scripts I have seen so
> far include these extra rules, but I can't wrap my head around it.
One reason may be if the explicit rules are there and the default policy
is changed (for whatever reason) then they are still blocked. Think
multiple layers of defense. Another may be that they want to silent
block those attacks and have a logging rule just before the packet would
be handed to the default policy.
--
Jamin W. Collins
"Never underestimate the power of very stupid people in large groups."
-- John Kenneth Galbraith
Reply to: