> Just wondering...it seems that most rule examples start out with > "block in all/block out all", wouldn't it more efficient to put "block > all" at the end of the rules and use "quick" to pass packets?
There are a variety of reasons why but most notably (for me at least) is that in many instances there are multiple things taking place on the same IP, port, or protocol, and you just don't want to block *all* of that traffic only some of it. By moving to a default block stance, you're able to do both selective passing and blocking sanely by IP, port, or protocol and not having to jump through mental hurdles to get there. Additionally, in many networks there are multiple people who're responsible for maintaining rules on many servers / firewalls, and seeing the default rules up top keeps things clean and sane--particularly in a heterogeneous firewall environment. > That would be one less rule that gets parsed. To (mis)-quote Henning, "Pfft. This is trivial." ;-) Kevin -- http://www.ebiinc.com : Employee Background Screening from EBI A leader in corporate background checks, worldwide.
