Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When writing an iptables(1) script, if you intend to check for invalid source IP addresses should you do so before or after accepted established traffic, and why?

share|improve this question

You want to accept established and related traffic first. This will usually be most of your traffic, and you want to process it as fast as possible. The connections will need to be accepted by other rules, before this rule will be applied.

If you are just learning about iptables firewalls, you may want to use a firewall builder to build your firewall for you. This will help you get the policies and common rules setup with a minimum of effort and likely of better quality than you could hand code. I like Shorewall, but there are several other tools available.

share|improve this answer

I always do a check against invalid source addresses in -t raw -A PREROUTING. By definition, -t raw takes place before conntrack, so obviously the check happens before the match for RELATED,ESTABLISHED.

My reasoning is that invalid source addresses are garbage, and I want to dedicate my firewall box's CPU cycles to non-garbage.

Yes, that introduces added latency to valid traffic, but it's practically undetectable, and my box can maintain very high throughput because garbage packets do not clog the netfilter/xtables pipelines. With some smart chain-branching, latency can be reduced significantly ;)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.