[prev in list] [next in list] [prev in thread] [next in thread] 

List:       freebsd-pf
Subject:    Re: drop vs return
From:       Chris Buechler <cmb () pfsense ! org>
Date:       2014-10-18 4:50:31
Message-ID: CAOmxWMUGToF0Ad59SrJypkkJoL7i-x1wm2BzK7V7q-cTe4indA () mail ! gmail ! com
[Download RAW message or body]

On Tue, Oct 14, 2014 at 2:54 PM, Laszlo Danielisz via freebsd-pf
<freebsd-pf@freebsd.org> wrote:
> Hi,
>
> Which is your set block-policy? Drop or Return?
> And why?
>

Depends on the circumstance. Generally speaking, for traffic sourced
from trusted networks, return so you don't hang applications or
services by blocking their traffic. It's friendlier. For any traffic
sourced from the Internet, or networks with devices that aren't
"trusted" (for whatever your definition of trusted), block so
untrusted machines can't make your firewall generate reply packets
(which will exacerbate a DoS/DDoS, among other potential issues).
_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"
[prev in list] [next in list] [prev in thread] [next in thread]