standard for dropping in a modular setup?
Mike <[email protected]> Sun, 15 Feb 2026 02:57:00 +0000
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <aZE1/DlyD/[email protected]> |
I imagine that this has been asked before; please point me to the discussion if so. It's well known that if you attach two base chains to a hook, and they both have a default drop policy, the lower priority chain will drop all the packets that were accepted in the other chain. So if you want to set up a configuration that aims to be "modular", you have to address the question of how to drop packets by default that were accepted by no chain. One way to do that would be to have a lowest priority base chain that drops packets that don't have a particular mark bit set. Then set that mark bit whenever you accept a packet in any other chain. The bit then serves as a "definitively accepted" flag. All the chains would use the default "accept" policy (but would not necessarily set this bit by default). The problem is then which bit do you choose. If all the rules are your own, it doesn't matter. But if you're trying to integrate your rules with those from another source like firewalld, there needs to be some agreement on which bit to use. So the question: is there any such agreement?