[no subject]

> I assumed REJECT was the same as if there was nothing listening on that
> port.

For TCP, connections to an unbound port are normally replied to with a TCP 
reset

For UDP, connections to an unbound port are normally replied to with a 
ICMP port unreachable

iptables -j REJECT by default does ICMP port unreachable replies for both 
TCP and UDP, so connections to a port filtered by -REJECT look the same as 
connections to an unbound port for UDP but different than connections to 
an unbound port for TCP

iptables -p tcp -j REJECT --reject-with tcp-reset for TCP rules will 
ensure that connections to that port receive a TCP reset in reply

The -j REJECT --reject-with tcp-reset is broken in a lot of vendors 
kernels, so if you want to use it, actually test it first and verify by 
packet capture that it does respond with a TCP reset and not an ICMP port 
unreachable

iptables -j DROP discards without response, so it's always different than 
an unbound port, and therefore always visible

later,
chris


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00118" href="msg00118.html">[ale] nmap and REJECT rules</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
<li><strong><a name="00120" href="msg00120.html">[ale] nmap and REJECT rules</a></strong>
<ul><li><em>From:</em> jrickman at gmail.com (Jonathan Rickman)</li></ul></li>
<li><strong><a name="00130" href="msg00130.html">[ale] nmap and REJECT rules</a></strong>
<ul><li><em>From:</em> jbaldwin at antinode.net (James Baldwin)</li></ul></li>
<li><strong><a name="00132" href="msg00132.html">[ale] nmap and REJECT rules</a></strong>
<ul><li><em>From:</em> cfowler at outpostsentinel.com (Christopher Fowler)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00138.html">[ale] nmap and REJECT rules</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00140.html">[ale] Anyone installed Linux on Fry's &quot;Great Quality&quot; laptops ?</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00138.html">[ale] nmap and REJECT rules</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00121.html">[ale] Screen Backgrounds</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00139"><strong>Date</strong></a></li>
<li><a href="threads.html#00139"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>