REJECT --reject-with icmp-host-unreachable vs DROP
m at rtij.nl
Mon Mar 27 11:21:31 CEST 2006
Brent Clark zei:
> Hi all
> Just something I would like to pick someones brain with.
> If I use the default policy of drop, BUT at the end of the chain use the
> $IPT -t filter -A FORWARD -j REJECT --reject-with icmp-host-unreachable
> Would that be ok, or does is another ICMP message I can reply back with.
If tcp, use tcp-reset instead. Different stacks can and do react
differently to an icmp-*-unreachable message. Sending back a tcp reset is
the correct thing to do according to the RFCs, and indeed all tcp/ip
stacks(1) understand this.
> Reason I ask this is because I find that by using the default policy
> (DROP), some applications keep retrying to make a connection etc.
> Where as this approach, seems to slow things down (I stand to correction
> on this).
Absolutely right. I personaly drop on the outside and reject on the
inside. Precisely for this reason.
(1) Except possibly some very broken stacks such as found in some embedded
machines. I recently had a chance to fight with the Zebra printserver
More information about the netfilter