Egress filtering vs non



  • I typically control the outbound port access from the LAN side using pfsense, mostly because I like the control.  I was wondering (yes I searched) if there were potential performance issues related to controlling the outbound access instead of just doing the default LAN -> ANY.

    Thanks for any information, I'll continue to search online.



  • Not unless you get really, really crazy with your rules. If you have a few hundred rules or less there won't be any measurable impact.

    That's definitely a better policy than allow all, that's just the default that most people want, not necessarily the best thing for your network.



  • I completely agree.  I see a tremendous amount of outbound traffic blocked, mostly spawned source ports.  I only have maybe 40 ports for outbound, it isn't too bad.  Thanks for the reply, something I've always wondered about and the only time I open up the LAN is when using greedy apps like Skype.


Log in to reply