@nealmcb I saw your notification. It's about time!

@RoryAlsop When you get a chance could you check over that iptables post again? I want to say it's completed, but I'm also sitting in a hotel lobby at 1am so who's to say :)

Please let me know if you think anything needs fleshing out.

@ScottPack I'd suggest a hyperlink or two early on to give non-networking-geeks for whom it isn't "obvious" some background

you describe the ESTABLISHED rule which is at the bottom, as "putting this at the top" - am I missing something?

you say if "Is this packet part of a connection in the state table" matches then you drop. There is an unmentioned "not" in that I think....

'Either way, there isn’t any typical benefit to allowing this traffic" - I'd be more interested in knowing what security benefit there is - are we talking about 0-days in the kernel? Real replays?

I'm guessing that the DF bit is the one you refer to in the previous sentence, but that wasn't clear to me on first read - might want to give its full name in the previous sentence or something?

"The above rule is one of them" - a rule is not a device

Some notion of what problems you might run into, how nasty they are, and how you could know, would make the rules a bit less scary

This is a bit puzzling: " fragmentation is a small enough problem that I don’t want to deal with risk and block it anyway". I guess you mean that there are security problems with fragmentation, and aren't many problems with rejecting fragmentation

And I don't understand "the reason to drop packets", which actually seems to explain that the proposed rule actually doesn't drop any but the first packet of a fragmented transmission. I'm lost....

References to other cool generic iptables scripts out there might also be useful.

@ScottPack And thus endith the requests for more lessons :) Thanks for writing it!

in the form this does not seem legit.

@HendrikBrummermann Indeed not. Additionally, it would seem to violate the "shopping recommendations" rule.