🚀 go-pugleaf

On Thursday 28 June 2001 18:04 Manfred Bartz wrote:

> Kaden <sfam@mailandnews.com> writes:
> 
>> Yes.  REJECT will treat the packet just as if the port was closed,
>> and send back the appropriate ICMP packet.
> 
> Except that an ICMP response is correct for a closed UDP port but
> not for a closed TCP port.

It seems to me I heard this somewhere before.  I had forgotten about it 
when I replied, though.  Thanks for the reminder.  However, it looks as 
if you need to update your site to show exactly what you just said.  It 
doesn't make a distinction between TCP or UDP ports.  It just says 
exactly what I said in my original reply.  The difference is implied at 
the end under "Revealing the existance of a firewall" but if it were me, 
I'd put that information right up top under the "reject" heading.  Just 
my opinion.

> To produce a genuine TCP reset response for selected ports, the best
> method is to pick a port that is guaranteed to not have a server
> listening on it (f.e. 65534), leave it open and redirect other ports
> to it.
 
This I hadn't heard of before.  I'd heard of redirecting to a port that 
was listening, but had fake services, or syslog set to listen to it or 
something like that, but not to an unopen port in the attempt to 
simulate closed TCP ports.

Funny how the simple things such as this tend to escape you as 
posibilites, isn't it?