Is there any actual difference between
iptables -P FORWARD DROP
net.ipv4.ip_forward = 0
I know that one is a firewall command while the other one is a kernel option. But:
- I don't know whether
net.ipv4.ip_forward = 0is enforced by netfilter or by the kernel directly.
- I don't know if there is any overhead associated with
iptables -P FORWARD DROPcompared to
net.ipv4.ip_forward = 0.
- I couldn't find any reference clearly stating that these two options are actually identical in their effect. That's what I understood, but I'm no netfilter/kernel expert.
In short, is there any actual difference between these two commands?