1 
drop proto tcp and not (dst port 80)

pass proto tcp and dst port 80

Is there a difference between them?

Improve this question
1
  • It's tagged iptables but the rules aren't iptables rules. Maybe pf or else some frontend?
    – A.B
    Apr 4, 2022 at 7:38

1 Answer 1

Reset to default
1

Well, the difference is simple.

  • first rule immediately drops non-HTTP
  • second rule immediately allows HTTP

Although it may trick you, these aren't even close. Because:

  • there are several types of traffic on the server, first rule just prohibits it.

  • in the same time it does not allows HTTP: whether or not HTTP will be allowed is determined by the subsequent rules or chain policy.

  • second rule, on the other hand, explicitly allows HTTP and doesn't tamper with everything else.

There are rare conditions where you need rules like first, so stick to the second ones unless you are absolutely sure why you need first one.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .