Is there any actual difference between

iptables -P FORWARD DROP


net.ipv4.ip_forward = 0


I know that one is a firewall command while the other one is a kernel option. But:

  1. I don't know whether net.ipv4.ip_forward = 0 is enforced by netfilter or by the kernel directly.
  2. I don't know if there is any overhead associated with iptables -P FORWARD DROP compared to net.ipv4.ip_forward = 0.
  3. I couldn't find any reference clearly stating that these two options are actually identical in their effect.

In short, is there any actual difference between these two commands?

  • There might be some differences in ICMP messages generated. For example, TTL exceeded, fragmentation needed, etc. Not sure. I spent a few minutes trying to read the kernel code... – derobert Oct 4 '13 at 4:58

When you disable packet forwarding between interfaces the FORWARD chain is ignored at all. So, in connection to performance which is where your question is targeted it does not make any difference.

You can check it doing:

iptables -L -vnx


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.