Welcome back.
This lecture will be about policy traffic filtering is done in the filter table of the input chain for
incoming traffic of the output chain for outgoing traffic and of the chain for her outside traffic rules
are added to chains and tables and traversed in order from top to bottom by the packet.
Expect it is then checked against Eglinton starting at the top, if it matches the goal, then an action
is taken such as accepting or dropping the packet.
Once a rule has been mixed and an action taken, the packet is processed according to the target of
a vegetable and isn't processed by further rules in the chain.
Now, if a package passes down through all the rules in the chain and reaches the bottom without being
matched against any rule, then the default policy for that chain is applied.
The default action is referred to as the default policy and may be set to either accept or drop the
concept of default policies or raises two possibilities that we must consider before deciding how we
are going to organize the firehole.
So when organizing our firewall, we should have the following options in mind.
We can set the default policy to drop all packets and then add the rules to specifically allow packets
that may be from trusted IP addresses or for certain ports on which we have services running like FTB
Web e-mail and so on.
Or the second possibility we can set the default policy to accept all packets and then add the rules
to specifically block or dropkicks that may be from specific IP addresses or ranges or for certain ports
on which we have private services.
Generally, the first option is to use at least for the input chain and is considered more secure.
By default, policy is set to accept any package that hasn't been dropped by any actual policy can be
exchanged for actions that have the filter table in that they are input output and forward.
We cannot change the policy for pre routing or post routing change.
Let's take a look at some examples.
We can check the policy by listing the final IP tables minus Al.
This is the default firewall for a Linux operating system.
We see the default policy is accept for input output and for the change note the fact that there is
no rule in the exchange.
So all traffic is permitted.
Now, I'll continue sleeping with Linux and also check the SSX connection.
Ping and the IP address of Linux on.
Boeing is working and now S.H..
S.H. is working to.
Both incoming Pink and S.H. are working.
Now, if I set the policy to drop on input chain, all the traffic will be dropped.
There is no rule of it except traffic.
So all traffic is dropped, IP tables minus B and uppercase P input drop.
This is how we set the policy.
We see that the policy is dropped and it has already dropped four packets, being has stopped, it doesn't
work anymore.
Setting the drug policy on input chain without any rule that accepts traffic is like ideologically disconnected
the host from the network.
Now I'll add a rule that allows incoming SSX traffic the input chain.
It's incoming traffic.
The protocol is Tsipi, the destination for 22 minus the target is accept.
Let's try to connect using SSX again.
And it's working, we noticed how SSX client can connect to the server again.
The SSX traffic is permitted by the school.
But what about pink?
Bing is still not working.
Pink pancakes are dropped by the policy.
There are 15 packets dropped now there are 19 packets.
22 packets and so on, Pink is continuously sending packets to Linux one.
If I want to permit incoming ICMP pink pancakes, I should add a rule that accepts that traffic.
Also note that policy is always at the end of the chain.
It's not possible to read the rules that makes against pancakes after the policy.
At the end of this lecture, I'd like to tell you something important.
Take care to win changing the policy on remote servers.
There is always the possibility to block yourself from accessing the server anymore.
First, to be sure that you've added a rule that allows your own traffic and only then change the default
policy.
Keep this in mind.