Re: REJECT --reject-with icmp-host-unreachable vs DROP

[Menno Smits <menno@netboxblue.com>]

Brent Clark wrote:
> Hi all
> 
> Just something I would like to pick someones brain with.
> 
> If I use the default policy of drop, BUT at the end of the chain use
> the following
> 
> $IPT -t filter -A FORWARD -j REJECT --reject-with
> icmp-host-unreachable
> 
> Would that be ok, or does is another ICMP message I can reply back
> with.

icmp-host-unreachable is fine. The default for the REJECT target is
icmp-port-unreachable which is ok too. If you want to make
troubleshooting easier you may want to want to tailor the ICMP reply
according to the reason that a packet was blocked (ie. was a host
blocked, a network or a port). It doesn't matter too much though.

Do an "iptables -j REJECT --help" to see the available reject types.

> Reason I ask this is because I find that by using the default policy
>  (DROP), some applications keep retrying to make a connection etc.
> 
> Where as this approach, seems to slow things down (I stand to
> correction on this).

Most applications/IP stacks will keep retrying for a while because with
a DROP there is no ICMP packet going back to let the sender know that
its traffic isn't getting through. The packet is just stopped without
letting the sender know. The sender assumes the packet was lost and
tries again until some sort of timeout is reached.

If you use REJECT an ICMP packet is sent back so that the sender know 
that its packet won't get through. This way it won't bother retrying and 
will give up immediately.

Note that this isn't always true. Some applications seem to ignore the 
ICMP reject packets coming back and will keep retrying anyway. The 
built-in command line Windows telnet application seems to do this. I'm 
not sure if this is a Windows thing or just the telnet program.

There are some situations where you should just use DROP instead of 
REJECT, usually for performance reasons where your netfilter machine has 
to deal with a high traffic volume and can't afford to send REJECTs. You 
might also want to use DROP when you get traffic that is almost 
definitely malicious. There's no point in sending a nice REJECT in this 
case.

> If someone could maybe help me understand this or assit I would be
> most grateful.

I hope I've explained it clearly enough.

Menno