iptables -P FORWARD DROP, good or bad?

Is your machine a router? Is it expected to do something with packets that it receives that are not destined for your machine?

You can safely drop packets if you are not expected to forward them, though it's probably a sign of a misconfigured network if you are receiving them.


The FORWARD chain is used to manage packets that are being routed through the machine. If the machine is a router then dropping all packets in the FORWARD chain would be bad. If it's not a router then you can drop packets in the FORWARD chain (if they ever get there).