Is there a difference between doing
and doing at the end of a firewall script
?

I know that -P sets the default policy and -A appends a rule, but is there a difference in results?

On its own, to set the policy to accept is the same as accepting all. Consider the more common case of setting the polict to drop, and then appending a number of rules to accept, for example accept http on port 80 and ftp on port 21. Iptables would then accept packets sent to ports 21 and 80 and drop all others. Not the same as simply dropping all.

Clearly having a policy to accept everything with accepting rules as per above means nothing, but you could selectively drop packets. I believe the previous example is more common (effectively block everything and open holes rather than open everything and block parts off)

In other words, the policy is what happens when all rules have been checked.

OK, let's say it uses DROP instead. Is the end result the same -- all packets not matching a specific rule get dropped?

That's the effect..

http://iptables-tutorial.frozentux.n...-tutorial.html