Security Guide example firewall as good as nothing?

[original_PQ]

I copied almost the whole example firewall script from The Gentoo Security Guide.
It was very stupid of me not to test the blocked ports after installing, because I just found after few weeks that the script has a huge hole. The firewall lets (almost) everything through!
I found out that it's the delay-flags chain (the last instruction) that lets all incoming connections through. I commented the whole chain out and the hole was gone.

Now, could someone tell me, have I done something wrong or is there a major flaw in the example script?
Or have I just understood it wrong?
No need to say that I didn't understand everything about every instruction.

Here's my script:

[klieber]

I've never particularly cared for that firewall ruleset -- it's very convoluted, IMO. Not sure exactly where the problem is and I don't feel like spending the time to trace the logic through and figure it out.

At first glance, I don't see a default deny rule, especially on the delay-flags chain, but like I said, I didn't spend that much time looking at it.

I highly recommend Oskar Andreasson's IPTables Tutorial. The code is cleanly delineated and (gasp) has plenty of comments to help folks new to IPTables follow the logic. In addition to being a great tutorial, it also contains several sample scripts for vanilla firewalls, firewalls with a DMZ and firewalls for DHCP users as well as others.

The rulesets have been carefully vetted by several people and the overall tutorial has gone through several revisions, so its a fairly mature script. Definitely worth checking out.

(And, for the record, I use the rc.DHCP.firewall.txt script as a basis for the script on my firewall)

--kurt
_________________
The problem with political jokes is that they get elected

[masseya]

Wow, thanks for all those links klieber. They are very helpful!
_________________
if i never try anything, i never learn anything..
if i never take a risk, i stay where i am..

[original_PQ]

Yeah, thanks klieber!

That delay-flags ruleset is directly from the Security Guide example, and if it has that kind of a hole...
Well, it shouldn't be part of the example, IMHO.

I thought the delay-flags ruleset is for dropping certain types of packets from the chain if they occur too often (a.k.a flood protection). Obviously it does something else.

Perhaps I'm whining in a wrong place.