Re: iptables: drop or reject?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



El Jueves, 25 de Octubre de 2007 19:54, Ashley M. Kirchner escribió:
>     To drop or not to drop, that is the question.  If there's a server
> out there sending spam e-mail, and I use iptables to block it, is it
> best to simply drop the packet, or should I do a '--reject-with
> icmp-host-unreachable' (or 'icmp-port-unreachable') or just a 'tcp-reset'?
>
>     Basically, if I just drop the packet, the server in question would
> simply continue to send stuff, wouldn't it?  As far as it knows, its
> spam reached the destination, whereas if I send something back, it might
> actually acknowledge and stop?  Yes?  No?
>

Basically, "drop" means that nothing is sent back to the host that sent the 
packet. On the other hand, "reject" means that the packet is dropped, but an 
error packet is sent to the packet's originator.

In this case, I would choose to drop packets since they're not going to stop, 
it's better to do not increase the packets on your interface.

Hope this helps.
Manuel
--
Manuel Arostegui Ramirez.

Electronic Mail is not secure, may not be read every day, and should not
be used for urgent or sensitive issues.


[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux