Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like iptables to disallow the sending of a "port closed" (RST ACK) in the OUTPUT chain.

I am not sure if this is correct:

--append OUTPUT --protocol tcp --tcp-flags RST,ACK RST,ACK --jump REJECT --reject-with icmp-host-prohibited
share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

That looks correct. It would be more normal just to block the SYN packets from reaching the service in the first place though, rather than blocking the response like that.

share|improve this answer
    
Reason: If the daemon is listening, then I'm good. But if the daemon is unavailable, I do not want outgoing "port closed" packets. –  Jacob Rickens Jun 21 '11 at 9:55
add comment

Not sure what effect your rule (if any) actually would have; do a DROP instead of REJECT.

See iptables: REJECT vs DROP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.