FreeBSD performance tuning: Sysctl parameter, loader.conf, kernel

I’d recommend against options IPFIREWALL_DEFAULT_TO_ACCEPT. The default is to Default to Deny. The firewall comes up with just one rule deny ip from any to any and stays that way until a script configures exactly what traffic should get through.

Follow-Up Note: RSA (one of the world’s leading security technology companies) was hacked recently when part of their firewall was disabled during a maintenance window. This really underscores how quickly a system can be compromised given the right conditions.

If you insist on disabling the firewall until you explicitly block unwanted traffic, please consider using the sysctl available by adding net.inet.ip.fw.default_to_accept=1 to loader.conf. This has the added benefit of being easily modified (no recompiling the kernel) if you change your mind at some point in the future.

Leave a Comment