I would like iptables to disallow the sending of a "port closed" (RST ACK) in the OUTPUT chain.

I am not sure if this is correct:

--append OUTPUT --protocol tcp --tcp-flags RST,ACK RST,ACK --jump REJECT --reject-with icmp-host-prohibited

2 Answers 2


That looks correct. It would be more normal just to block the SYN packets from reaching the service in the first place though, rather than blocking the response like that.

  • Reason: If the daemon is listening, then I'm good. But if the daemon is unavailable, I do not want outgoing "port closed" packets. Jun 21, 2011 at 9:55

Not sure what effect your rule (if any) actually would have; do a DROP instead of REJECT.

See REJECT vs DROP when using iptables.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.