The optimum way to use iptables and ipsets

[spalife]

Started a general discussion thread so that everyone
can pitch in with their opinions about the ways
which using iptables and ipsets can benefit the end user.

 

[spalife]

Not to inflame anyone
just partially quoted the current discussion,
so that we can have a productive use of this thread.

The initial quotes for historical purposes are available
on this thread

kvic said: ↑
it's more efficient to use "filter" rather than "raw" tables

Adamm said: ↑
Blocking a packet in raw means not only are there 4 less layers of processing by the kernel, but there's no overhead of conntracking.