Set the INPUT chain's default action to drop packets not explicitly allowed.
Adding individual allow rules is separate.
Which command is appropriate?
iptables -P CHAIN POLICY sets the default policy. This differs from appending a DROP rule with -A.
Detailed explanation
iptables -L INPUT DROPIncorrect. -L lists rules and does not set policy.
Incorrect. -L lists rules and does not set policy.
iptables -A INPUT -j DROPIncorrect. Appending a DROP rule can be affected by earlier rules and is not the default policy.
Incorrect. Appending a DROP rule can be affected by earlier rules and is not the default policy.
iptables -P INPUT DROPCorrect. It sets INPUT's default policy to DROP.
Correct. It sets INPUT's default policy to DROP.
iptables --state INPUT DROPIncorrect. --state is used for connection-state matching.
Incorrect. --state is used for connection-state matching.
Try it yourself
An example you can run in a temporary verification environment.
iptables --help 2>&1 | grep -E -- 'policy|^-P' | head -n 3Expected result
policyまたは-Pに関するhelp行Key points
- -P sets policy
- INPUT chain
- Different from adding a rule
Notes
- Environment: iptables help / policy変更なし
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.