Re: Packet filtering (ipchains)

Article View: comp.os.linux.setup

Article #51

Back to comp.os.linux.setup Previous Next

#51

From: Manfred Bartz
Date: Fri, 29 Jun 2001 00:04

26 lines
2198 bytes

Kaden <sfam@mailandnews.com> writes:

> Yes.  REJECT will treat the packet just as if the port was closed,
> and send back the appropriate ICMP packet.

Except that an ICMP response is correct for a closed UDP port but 
not for a closed TCP port.

    <http://logi.cc/linux/reject_or_deny.php3>

To produce a genuine TCP reset response for selected ports, the best
method is to pick a port that is guaranteed to not have a server
listening on it (f.e. 65534), leave it open and redirect other ports
to it.

This method works for ipchains as well as netfilter.
I need to update my webpage for that.

> DENY will simply drop the packet and ignore it and the sender.

Yes.  DENY (DROP for netfilter) is probably best for most systems.

-- 
Manfred
----------------------------------------------------------------
NetfilterLogAnalyzer, NetCalc, whois at: <http://logi.cc/linux/>

Technical Details

Message-ID: <m28zickv4n.fsf@reddwarf.xix.net>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!newshub1.rdc1.nsw.optushome.com.au!news1.eburwd1.vic.optushome.com.au.POSTED!not-for-mail

References:

<3b3a793d@usenet.per.paradox.net.au> <m2vglho09t.fsf@reddwarf.xix.net> <3b3b22d7@usenet.per.paradox.net.au> <9hgd3a$68r$1@news.xmission.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f9b51,9de258465609deaf
X-Google-Attributes: gidf9b51,public
X-Google-Thread: 102983,9de258465609deaf
X-Google-Attributes: gid102983,public
X-Google-ArrivalTime: 2001-06-28 17:09:46 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!newsfeed.stanford.edu!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!news1.optus.net.au!optus!newshub1.rdc1.nsw.optushome.com.au!news1.eburwd1.vic.optushome.com.au.POSTED!not-for-mail
Newsgroups: comp.os.linux.setup,aus.computers.linux
Subject: Re: Packet filtering (ipchains)
References: <3b3a793d@usenet.per.paradox.net.au> <m2vglho09t.fsf@reddwarf.xix.net> <3b3b22d7@usenet.per.paradox.net.au> <9hgd3a$68r$1@news.xmission.com>
X-PGP-KeyID: available on request
From: Manfred Bartz <mdadd329ea@xix.com>
Organization: Hmm? What organization?
Message-ID: <m28zickv4n.fsf@reddwarf.xix.net>
Lines: 26
User-Agent: Gnus/5.0803 (Gnus v5.8.3) XEmacs/21.1 (Bryce Canyon)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Fri, 29 Jun 2001 00:04:35 GMT
NNTP-Posting-Host: 203.164.4.223
X-Complaints-To: abuse@optushome.com.au
X-Trace: news1.eburwd1.vic.optushome.com.au 993773075 203.164.4.223 (Fri, 29 Jun 2001 10:04:35 EST)
NNTP-Posting-Date: Fri, 29 Jun 2001 10:04:35 EST

Reply to Parent Message