Re: IPTABLES doesn't work

[Luciano Miguel Ferreira Rocha]

On Fri, Jan 30, 2004 at 12:13:18PM +0100, Alexander Dalloz wrote:
>  > /sbin/modprobe ip_conntrack_ftp &> /dev/null
>  
>  modprobe has the parameter "-q" to be quiet. 
Thanks, I didn't know.

>  > /sbin/iptables -F
>  > /sbin/iptables -X
>  > /sbin/iptables -P FORWARD DROP
>  > /sbin/iptables -P INPUT DROP
>  
>  To set policies to DROP and have no final REJECT rule is bad. DROP is no
>  good general rule. 
That's a matter of opinion, but for completion I do use rejects, but I tried
to simplify the script:

/sbin/iptables -A INPUT -p TCP -m limit --limit 20/minute -j REJECT --reject-with
tcp-reset
/sbin/iptables -A INPUT -p UDP -m limit --limit 20/minute -j REJECT --reject-with
icmp-port-unreachable

(I don't like the default reject method.)

Regards,
Luciano Rocha