standard for dropping in a modular setup?

Mike <[email protected]> Sun, 15 Feb 2026 02:57:00 +0000
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <aZE1/DlyD/[email protected]>
I imagine that this has been asked before; please point me to the discussion
if so.

It's well known that if you attach two base chains to a hook, and they both
have a default drop policy, the lower priority chain will drop all the
packets that were accepted in the other chain.  So if you want to set up a
configuration that aims to be "modular", you have to address the question of
how to drop packets by default that were accepted by no chain.

One way to do that would be to have a lowest priority base chain that drops
packets that don't have a particular mark bit set.  Then set that mark bit
whenever you accept a packet in any other chain.  The bit then serves as a
"definitively accepted" flag.  All the chains would use the default "accept"
policy (but would not necessarily set this bit by default).

The problem is then which bit do you choose.  If all the rules are your own,
it doesn't matter.  But if you're trying to integrate your rules with those
from another source like firewalld, there needs to be some agreement on which
bit to use.

So the question: is there any such agreement?