Description:

When IPTABLES_FORWARD is set to 1 in /etc/conf.d/iptables, the iptables rc script executes "echo 1 > /proc/sys/net/ipv4/ip_forward". This is all well and good, except that the shipped default is to turn forwarding on, which is unexpected and potentially dangerous from a security perspective. It assumes that people who install iptables are doing so to run NAT, which isn't always true. Furthermore, from a security and "knowing your system" point of view, I believe turning something like forwarding on should be an active measure, even if most people end up doing so.

Additional info:
* package version(s)
$ pacman -Q iptables
iptables 1.4.5-1

* config and/or log files etc.
$ grep IPTABLES_FORWARD /etc/conf.d/iptables
IPTABLES_FORWARD=0 # enable IP forwarding?


Steps to reproduce:
$ sudo pacman -S iptables
$ sudo /etc/rc.d/iptables start
$ cat /proc/sys/net/ipv4/ip_forward
1