When writing an iptables(1) script, if you intend to check for invalid source IP addresses should you do so before or after accepted established traffic, and why?
You want to accept established and related traffic first. This will usually be most of your traffic, and you want to process it as fast as possible. The connections will need to be accepted by other rules, before this rule will be applied.
If you are just learning about iptables firewalls, you may want to use a firewall builder to build your firewall for you. This will help you get the policies and common rules setup with a minimum of effort and likely of better quality than you could hand code. I like Shorewall, but there are several other tools available.
I always do a check against invalid source addresses in
My reasoning is that invalid source addresses are garbage, and I want to dedicate my firewall box's CPU cycles to non-garbage.
Yes, that introduces added latency to valid traffic, but it's practically undetectable, and my box can maintain very high throughput because garbage packets do not clog the netfilter/xtables pipelines. With some smart chain-branching, latency can be reduced significantly ;)