I've encountered some iptables configuration with incoming rules starting with a rule that allows all TCP packets with ACK flag, followed by all the obvius service port rules. Why is that? The server still responds with this rule disabled. Is there a useful acceptance of ACK for other ports then the served services ones?
The person that engineered the firewall is probably the best person to answer the
If I take a stab at finding a useful use case:
Premise: TCP packets with the ACK flag are common
Premise: Will stop evaluating at the matching first
Assumption: ACK packets are largely harmless
Conclusion: The ACK statements may have been added to increase Firewall performance.
I don't have any benchmarking to back up such an assumption.