What should one do when one finds an answer with an example that could create a security issue?

Question

As I'm working on a tool to manage my firewalls, I stumbled on this answer:

Block SYN,ACK response with iptables

which include two lines of code like so:

# iptables -A INPUT -p tcp -m state --state NEW \
             -m recent --update --seconds 60 --hitcount 20 -j DROP
# iptables -A INPUT -p tcp -m state --state NEW -m recent --set -j ACCEPT

My concern is that the second line uses -j ACCEPT which opens the firewall 100% at that point. Rules appearing after that point will have no effect. For example, if I only wanted to open port 80 like so:

# iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
# iptables -A INPUT -j DROP

those two rules would be ignored.

So I see that as a potential security issue in the answer and someone who does not test their firewall thoroughly could end up with a really bad one.

Is there anything being done on this stack in such circumstances?

For now, I just posted a comment. I would imagine that's the best course of action I can use at the moment.

Answer 1

Comments are the best way to handle this. Hopefully, the one who posted the answer would correct the issues.