Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like iptables to disallow the sending of a "port closed" (RST ACK) in the OUTPUT chain.

I am not sure if this is correct:

--append OUTPUT --protocol tcp --tcp-flags RST,ACK RST,ACK --jump REJECT --reject-with icmp-host-prohibited
share|improve this question
up vote 0 down vote accepted

That looks correct. It would be more normal just to block the SYN packets from reaching the service in the first place though, rather than blocking the response like that.

share|improve this answer
Reason: If the daemon is listening, then I'm good. But if the daemon is unavailable, I do not want outgoing "port closed" packets. – Jacob Rickens Jun 21 '11 at 9:55

Not sure what effect your rule (if any) actually would have; do a DROP instead of REJECT.

See iptables: REJECT vs DROP.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.