Brent Clark zei: > Hi all > > Just something I would like to pick someones brain with. > > If I use the default policy of drop, BUT at the end of the chain use the > following > > $IPT -t filter -A FORWARD -j REJECT --reject-with icmp-host-unreachable > > Would that be ok, or does is another ICMP message I can reply back with. If tcp, use tcp-reset instead. Different stacks can and do react differently to an icmp-*-unreachable message. Sending back a tcp reset is the correct thing to do according to the RFCs, and indeed all tcp/ip stacks(1) understand this. > Reason I ask this is because I find that by using the default policy > (DROP), some applications keep retrying to make a connection etc. > Where as this approach, seems to slow things down (I stand to correction > on this). Absolutely right. I personaly drop on the outside and reject on the inside. Precisely for this reason. HTH, M4 (1) Except possibly some very broken stacks such as found in some embedded machines. I recently had a chance to fight with the Zebra printserver stack. Ugly.
