When should a "match all packets" rule be used (instead of chain policy)?

I think that this should be used in real time applications like audio streaming or video broadcasting. Are there other situations?

2 Answers 2


Whenever it's the easiest way to define your rules.

Modern firewalls are more than capable of dealing with dozens, hundreds or even thousands of rules without much of a performance hit, so the general rule is to make your rules easy to administer and to make sure your device performs the function you intend.

That means; if your device only does one job with one type of packet, set up your defaults to deal with that type of packet and you're done. If however you need to deal with multiple types in various ways, well, separate policies may be easier to deal with rather than letting things fall through to your default because you can change their priority in your chain, add rules afterwards, etc. - doing it that way also means that your device does nothing you don't explicitly intend (assuming your default is deny all).

For real-time streaming, video broadcasting and the like we have QoS which on most devices you can include or associate with your streaming rules.


One reason in iptables is that rules can do things that chain policies can't. Chain policies can only accept or drop, rules can do many other things such as rejecting packets.

Another reason is it can make reconfiguration safer. If your default chain policy is accept then flushing the chain to reconfigure will leave the firewall temporally wide open. If your default chain policy is drop then flushign the chain to reconfigure will leave the firewall temporerally completely closed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .