drop vs return

[Chris Buechler]

On Tue, Oct 14, 2014 at 2:54 PM, Laszlo Danielisz via freebsd-pf
<freebsd-pf at freebsd.org> wrote:
> Hi,
>
> Which is your set block-policy? Drop or Return?
> And why?
>

Depends on the circumstance. Generally speaking, for traffic sourced
from trusted networks, return so you don't hang applications or
services by blocking their traffic. It's friendlier. For any traffic
sourced from the Internet, or networks with devices that aren't
"trusted" (for whatever your definition of trusted), block so
untrusted machines can't make your firewall generate reply packets
(which will exacerbate a DoS/DDoS, among other potential issues).