Jonathan Camenisch wrote: > This is sort of an academic question, I guess. Hopefully, this is an > ok place to post it. > > Just wondering...it seems that most rule examples start out with > "block in all/block out all", wouldn't it more efficient to put "block > all" at the end of the rules and use "quick" to pass packets? That > would be one less rule that gets parsed.
Lopping off one rule doesn't matter in any real way. It will never be the difference between a "too slow" system and a "fast enough" system. It will never cause more work to be done in your office. It will never be felt. It is unlikely to even be measured. (Insert Gentoo joke here). This is a place where a human error will cost much more than any savings of one rule. PF is plenty fast that for most apps, readability should take precidence over "efficiency", especially an efficiency that Just Doesn't Matter. The default of PF is to "pass all". If you wish to have a tight firewall, you generally want to have a "block all" default. Say it. Get it over with. Now, start passing the stuff you want to pass, and only that stuff. I suspect more people will find the results more "readable" that way. Your strategy mandates a "quick" on every pass rule. That may not be desired; if you mandate that "every rule must include a 'quick'", you cripple some of PF's flexibility. If that was desired, the "quick" would be implied, and PF would be a "First matching rule wins", rather than "Last matching rule wins" system. You can probably accomplish most tasks either way, but PF gives you both. Plus, if you happen to forget one of those "quick"s, you might spend a lot of time looking for the problem... Nick.
