On 5/4/05, Jonathan Camenisch <[EMAIL PROTECTED]> wrote:
> Just wondering...it seems that most rule examples start out with
> "block in all/block out all", wouldn't it more efficient to put "block
> all" at the end of the rules and use "quick" to pass packets? That
> would be one less rule that gets parsed.
Putting in "block all" as the very first rule ensure the "default deny"
security posture of the packet filter is made explicit.
man pf.conf
. . .
For each packet processed by the packet filter, the filter rules are
evaluated in sequential order, from first to last. The last matching
rule decides what action is taken.
. . .
If no rule matches the packet, the default action is pass.
To block everything by default and only pass packets that match explicit
rules, one uses
block
as the first filter rule.
. . .
Not everybody wants to build their policy with "quick", so this
approach allows the operator to override the "default deny" policy
selectively, without having to worry about accidentally passing
traffic because of a missing "deny" rule at the end of the policy.
There's no reason why you cannot build your policy upside down,
if you so choose. Starting out a policy with 'block" as the first
filter rule is inherently a style decision, not an absolute requirement.
Kevin Kadow
