0

I would like iptables to disallow the sending of a "port closed" (RST ACK) in the OUTPUT chain.

I am not sure if this is correct:

--append OUTPUT --protocol tcp --tcp-flags RST,ACK RST,ACK --jump REJECT --reject-with icmp-host-prohibited

2 Answers 2

0

That looks correct. It would be more normal just to block the SYN packets from reaching the service in the first place though, rather than blocking the response like that.

1
  • Reason: If the daemon is listening, then I'm good. But if the daemon is unavailable, I do not want outgoing "port closed" packets. Jun 21, 2011 at 9:55
0

Not sure what effect your rule (if any) actually would have; do a DROP instead of REJECT.

See REJECT vs DROP when using iptables.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .