Absolute iptables beginners question

[elija]

I've been reading this tutorial and one thing confuses me slightly.

# iptables -P INPUT ACCEPT
 # iptables -F

The first command sets the default policy for the input chain and the second drops all existing rules. It is implied in the tutorial that the first rule you set here is left in place by the flush.

How does it know to ignore it? Does it leave all the default policies in place?

These are probably a really dumb questions but I'm asking them anyway

[Krendoshazin]

The policy of a chain is simply what netfilter should do if a packet does not meet the rules you've specified. By setting it to accept you're saying, "allow any packets through that do not meet these rules". If you flush the rules, then this is basically the same as deleting each rule one by one until there are none left.

By setting the policy to accept and then flushing the rules, it's telling netfilter to accept everything.

[Irithori]

To repeat and add:
The default policy is handled a bit different than your other rules.

The basic idea is: If none of the defined rules match, do what the default policy says.
Kind of like routing. If nothing else matches, use the default gw.

The default policy is unaffected by flushs. It needs to be set explicitly.
Which leads to the common error of setting a REJECT default (as it should be on a fw), and then flush: You are locked out.

[elija]

Yeah that does make sense. And now I have my head around around the differences iptables rules are fairly straight forward.

The default policy is unaffected by flushs. It needs to be set explicitly.
Which leads to the common error of setting a REJECT default (as it should be on a fw), and then flush: You are locked out.

Which would be a bummer in a remote data centre

[Lazydog]

Here is another tutorial you can look through that is a bit more detailed.

Iptables Tutorial

[elija]

Here is another tutorial you can look through that is a bit more detailed.

Iptables Tutorial

That's a fair bit of reading and has been bookmarked for future consumption.