Mogens Valentin wrote:
Sometimes questions pop up on various network lists about execution
order of rules.
Such questions are usually dealt with per example, but I sometimes
ponder about general guidelines, or try to logically derive my own.
Gnerally I like to put the rule(s) that will match the highest percentage of the time towards the top followed by the next highest percent matched rules on down the list to the least likely to match at the botom. The idea behind this is to have the most common packets match rules at the top (start) of the list so they have to traverse as few rules as possible.
If you are going to have a LARGE block of IPs that you are going to match on, namely each IP in a class (C)
256 / 4
64 / 4
16 / 4
4 / 4
