On 07/30/2010 12:00 PM, Jan Engelhardt wrote: > > Ref: http://marc.info/?l=netfilter&m=128043201731932&w=2 > > On Thursday 2010-07-29 21:33, Lars Nooden wrote: >> On 7/29/10 10:09 PM, Elmar Stellnberger wrote: >>> iptables -A mychain -m owner --gid-owner blockedusergroup -j DROP >> >> For starters, consider using the REJECT target instead of DROP if for no other >> reason than that it will make your engineering easier: >> >> http://www.chiark.greenend.org.uk/~peterb/network/drop-vs-reject > > That page - especially the summary - is leaving out one essential feature > Gáspar already mentioned it in another thread; the CHAOS target from > Xtables-addons. CHAOS and TARPIT look about the same as DROP in regards to the question of REJECT vs DROP. The same arguments apply about a quick response from the filter or not. http://www.chrisbrenton.org/2009/07/why-firewall-reject-rules-are-better-than-firewall-drop-rules/ http://www.chiark.greenend.org.uk/~peterb/network/drop-vs-reject /Lars -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
