Set the INPUT chain's default action to drop packets not explicitly allowed.
Adding individual allow rules is separate.
Which command is appropriate?
iptables -P CHAIN POLICY sets the default policy. This differs from appending a DROP rule with -A.
Detailed explanation
iptables -L INPUT DROPIncorrect. -L lists rules and does not set policy.
iptables -A INPUT -j DROPIncorrect. Appending a DROP rule can be affected by earlier rules and is not the default policy.
iptables -P INPUT DROPCorrect. It sets INPUT's default policy to DROP.
iptables --state INPUT DROPIncorrect. --state is used for connection-state matching.
Try it yourself
An example you can run in a temporary verification environment.
iptables --help 2>&1 | grep -E -- 'policy|^-P' | head -n 3Expected result
policyまたは-Pに関するhelp行Key points
- -P sets policy
- INPUT chain
- Different from adding a rule
Notes
- Environment: iptables help / policy変更なし
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Protected account data
Sensitive authentication data stored separately from ordinary account records.
Service availability
Whether a service can start automatically or be activated on demand.
Packet filter
A host firewall rule set that permits or rejects network packets.