Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When should a "match all packets" rule be used (instead of chain policy)?

I think that this should be used in real time applications like audio streaming or video broadcasting. Are there other situations?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Whenever it's the easiest way to define your rules.

Modern firewalls are more than capable of dealing with dozens, hundreds or even thousands of rules without much of a performance hit, so the general rule is to make your rules easy to administer and to make sure your device performs the function you intend.

That means; if your device only does one job with one type of packet, set up your defaults to deal with that type of packet and you're done. If however you need to deal with multiple types in various ways, well, separate policies may be easier to deal with rather than letting things fall through to your default because you can change their priority in your chain, add rules afterwards, etc. - doing it that way also means that your device does nothing you don't explicitly intend (assuming your default is deny all).

For real-time streaming, video broadcasting and the like we have QoS which on most devices you can include or associate with your streaming rules.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.