[gentoo-user] netfilter: -P INPUT DROP in kernel

[Daniel Waeber]

Benno Schulenberg wrote:
 > (By the way, please do not reply to another message when starting a
 > new topic.)
 >
 > Benno

Sorry for that. So I start a new thread now.


 > Daniel Waeber wrote:
 >> I was looking for a way to set the default rule for the INPUT
 >> chain to DROP. I do not want to change the rule with iptables -P
 >> INPUT DROP after loading the kernel, I want that the
 >> kernel/modules automatically DROPS everything after it has been
 >> loaded.
 >> You can do this with the FORWARD chain with the parameter
 >> forward=0, but nothing is implemented for the INPUT chain as far
 >> as i know. I looked inside the kernel source of the modules, and
 >> hey, it is easy to change. I recompiled the module, reloaded it.
 >> Perfect, now i have default DROP.
 >> But as it is so easy to edit, why is there no option in the
 >> kernel or a parameter for the module
 >
 > Make a patch that adds this parameter, allowing one to set the
 > default policy for the input chain (and output chain too), and
 > submit it to the kernel list.  Or show it here first.  I'd be
 > interested.

Because I'm new to Linux, this is my first patch, so i don't know if 
everything is done right. Perhaps someone can examine it before I send 
it to kernel.org. I added code so you can pass the parameter "input=0" 
and "output=0" to the iptable_filter module to change the policies. It's 
the same code already implemented for the forward chain, which can be 
set to 0 to drop, 1 to accept.
I don't now if how/if this parameter can be passed, if netfilter is 
build inside the kernel, so perhaps this is not the perfect solution.

Have fun with a default denying firewall :)