On Wed, May 04, 2005 at 09:53:04AM -0500, Jonathan Camenisch wrote: > This is sort of an academic question, I guess. Hopefully, this is an > ok place to post it. > > Just wondering...it seems that most rule examples start out with > "block in all/block out all", wouldn't it more efficient to put "block > all" at the end of the rules and use "quick" to pass packets? That > would be one less rule that gets parsed.
I've seen rules in the past that had the block rules last, and did use quick rules to pass packets. Partially at a guess it's so you don't have to use quick rules for everything, and then also I think there's a bit of a "What happens if for some reason all the rules don't get parsed?". This may be a somewhat irrational fear, but if you have the block rules first, then always the default will be block, you don't wind up with a wide open firewall if for some reason your ruleset didn't load fully, or if some flaw in coding means that after 300 rules the firewall stops caring, and just acts based on the last match for that packet. Matt.
