Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there any actual difference between

iptables -P FORWARD DROP

and

net.ipv4.ip_forward = 0

?

I know that one is a firewall command while the other one is a kernel option. But:

  1. I don't know whether net.ipv4.ip_forward = 0 is enforced by netfilter or by the kernel directly.
  2. I don't know if there is any overhead associated with iptables -P FORWARD DROP compared to net.ipv4.ip_forward = 0.
  3. I couldn't find any reference clearly stating that these two options are actually identical in their effect. That's what I understood, but I'm no netfilter/kernel expert.

In short, is there any actual difference between these two commands?

share|improve this question
    
There might be some differences in ICMP messages generated. For example, TTL exceeded, fragmentation needed, etc. Not sure. I spent a few minutes trying to read the kernel code... –  derobert Oct 4 '13 at 4:58

1 Answer 1

up vote 0 down vote accepted

When you disable packet forwarding between interfaces the FORWARD chain is ignored at all. So, in connection to performance which is where your question is targeted it does not make any difference.

You can check it doing:

iptables -L -vnx

HTH

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.