Take the 2-minute tour ×

Is dropping all FORWARD packets bad? What are they used for? Why would I want to block them or keep them open?

(I fully understand INPUT and OUTPUT)

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Is your machine a router? Is it expected to do something with packets that it receives that are not destined for your machine?

You can safely drop packets if you are not expected to forward them, though it's probably a sign of a misconfigured network if you are receiving them.

share|improve this answer
Not a router. Just a web server –  Luke Sep 21 '11 at 20:03
In that case, you shouldn't expect to see any packets on the FORWARD chain (try -j LOG if you want to be sure you are getting one), and can DROP if you wish. –  crb Sep 21 '11 at 20:06

The FORWARD chain is used to manage packets that are being routed through the machine. If the machine is a router then dropping all packets in the FORWARD chain would be bad. If it's not a router then you can drop packets in the FORWARD chain (if they ever get there).

share|improve this answer
Nitpick/help for better understanding: FORWARD is a default chain, not a table. –  crb Sep 21 '11 at 20:04
You're right - thanks. –  Iain Sep 21 '11 at 20:08
+1 for having written 'Your' and then edited it to 'You're'. Cheekily, the inbox shows the initial comment. Sticklers unite :) –  crb Sep 21 '11 at 20:45

Your Answer


