Greetings, I have, what could be, a simple question. Do folks put their connection tracking rules near the top (earlier rule) of their ruleset, or near the bottom (later rule)? I used to believe that it "made sense" to have the conntrack rules earlier in the rule set, because the packets would be related/established and wouldn't need to hit the other rules unnecessarily. However, the conntrack requires more kernel memory to track the packets. Therefore if every connection is tracked, then that would drive up the memory required for having the conntrack track every connection/packet - thus possibly exhausting the memory and not allowing other packets through. So, now I am wondering if the conntrack rules should (always?) go at the end of my ruleset. Or do folks put the conntrack rules at the top/middle/bottom of the ruleset on a case-by-case basis? Thanks for any dialogue regarding this, perhaps obvious, topic. Cheers, -m
