As I'm working on a tool to manage my firewalls, I stumbled on this answer:
which include two lines of code like so:
# iptables -A INPUT -p tcp -m state --state NEW \ -m recent --update --seconds 60 --hitcount 20 -j DROP # iptables -A INPUT -p tcp -m state --state NEW -m recent --set -j ACCEPT
My concern is that the second line uses
-j ACCEPT which opens the firewall 100% at that point. Rules appearing after that point will have no effect. For example, if I only wanted to open port 80 like so:
# iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT # iptables -A INPUT -j DROP
those two rules would be ignored.
So I see that as a potential security issue in the answer and someone who does not test their firewall thoroughly could end up with a really bad one.
Is there anything being done on this stack in such circumstances?
For now, I just posted a comment. I would imagine that's the best course of action I can use at the moment.