Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any actual difference between

iptables -P FORWARD DROP


net.ipv4.ip_forward = 0


I know that one is a firewall command while the other one is a kernel option. But:

  1. I don't know whether net.ipv4.ip_forward = 0 is enforced by netfilter or by the kernel directly.
  2. I don't know if there is any overhead associated with iptables -P FORWARD DROP compared to net.ipv4.ip_forward = 0.
  3. I couldn't find any reference clearly stating that these two options are actually identical in their effect. That's what I understood, but I'm no netfilter/kernel expert.

In short, is there any actual difference between these two commands?

share|improve this question
There might be some differences in ICMP messages generated. For example, TTL exceeded, fragmentation needed, etc. Not sure. I spent a few minutes trying to read the kernel code... – derobert Oct 4 '13 at 4:58
up vote 0 down vote accepted

When you disable packet forwarding between interfaces the FORWARD chain is ignored at all. So, in connection to performance which is where your question is targeted it does not make any difference.

You can check it doing:

iptables -L -vnx


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.