RFC - sysadmin guidelines

[Mike McGrath]

On Fri, 16 Jan 2009, Frank Chiulli wrote:

> Mike,
> First let me say that the examples are a great addition to the page.
>
> I was looking at the iptables sample configuration and had some
> questions.  I compared your suggested configuration to my current
> configuration (Fedora 10).  With the exception of the lines with
> '--tcp-flags' in your sample configuration, they're pretty close.  I
> don't have those yet.  The first three lines that start with '-A' in
> your sample are the same as mine except the order is different.  Does
> the order make a difference?
>
> Here are the lines from my file:
> -A INPUT -m state --state ESTABLISHED,RELATED -j accept
> -A INPUT -p icmp -j ACCEPT
> -A INPUT -i lo -j ACCEPT
>
> Here are yours:
> -A INPUT -i lo -j ACCEPT
> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> -A INPUT -p icmp -j ACCEPT
>

The order isn't that important though I should really have
established,related come first.  The main reason for this is because
IPTables runs like a list, any already approved content doesn't have to
get checked against much of the list but instead is automatically
approved.

This has security implications but for most setups its a good policy.
I'll actually move that up now and refresh that page soon.

	-Mike