iptables: drop or reject?

[Rick Stevens]

On Thu, 2007-10-25 at 11:54 -0600, Ashley M. Kirchner wrote:
>     To drop or not to drop, that is the question.  If there's a server 
> out there sending spam e-mail, and I use iptables to block it, is it 
> best to simply drop the packet, or should I do a '--reject-with 
> icmp-host-unreachable' (or 'icmp-port-unreachable') or just a 'tcp-reset'?
> 
>     Basically, if I just drop the packet, the server in question would 
> simply continue to send stuff, wouldn't it?  As far as it knows, its 
> spam reached the destination, whereas if I send something back, it might 
> actually acknowledge and stop?  Yes?  No?

If you drop, the packets fall on the floor.  The remote machine will no
response at all and it appears as if your machine doesn't exist.  I
think that's best way to handle it.

If you respond at all (or do a reset), that indicates _something_ is at
that IP and, depending on how big an *sshole the attacker is, may cause
them to try other ways to assault you.

----------------------------------------------------------------------
- Rick Stevens, Principal Engineer             rstevens at internap.com -
- CDN Systems, Internap, Inc.                http://www.internap.com -
-                                                                    -
-  Perseverance:  When you're too damned stubborn to say "I quit!"   -
----------------------------------------------------------------------