Newb: Protocols

drudge · 09-17-2007, 01:30 PM

Hi I've always used Guarddog on my single home desktop.
It's only just occured to me that I don't know the difference
between a blocked and rejected protocol.
I've always set un-needed protocols as blocked.
Just wondering if someone could give a 'simple' explanation
of the difference.
Thanks

win32sux · 09-17-2007, 01:57 PM

With iptables you can filter packets with either the DROP or REJECT targets. Since Guarddog is an iptables front-end, I assume by "blocked" they mean "sent to DROP". Anyhow, here's the differences between the two, straight from Oskar Andreasson's famous iptables tutorial:

Quote:

The DROP target does just what it says, it drops packets dead and will not carry out any further processing. A packet that matches a rule perfectly and is then Dropped will be blocked. Note that this action might in certain cases have an unwanted effect, since it could leave dead sockets around on either host. A better solution in cases where this is likely would be to use the REJECT target, especially when you want to block port scanners from getting too much information, such as on filtered ports and so on. Also note that if a packet has the DROP action taken on it in a subchain, the packet will not be processed in any of the main chains either in the present or in any other table. The packet is in other words totally dead. As we've seen previously, the target will not send any kind of information in either direction, nor to intermediaries such as routers.

Quote:

The REJECT target works basically the same as the DROP target, but it also sends back an error message to the host sending the packet that was blocked. The REJECT target is as of today only valid in the INPUT, FORWARD and OUTPUT chains or their sub chains. After all, these would be the only chains in which it would make any sense to put this target. Note that all chains that use the REJECT target may only be called by the INPUT, FORWARD, and OUTPUT chains, else they won't work. There is currently only one option which controls the nature of how this target works, though this may in turn take a huge set of variables. Most of them are fairly easy to understand, if you have a basic knowledge of TCP/IP.

drudge · 09-17-2007, 03:16 PM

Quote:

Originally Posted by win32sux

With iptables you can filter packets with either the DROP or REJECT targets. Since Guarddog is an iptables front-end, I assume by "blocked" they mean "sent to DROP". Anyhow, here's the differences between the two, straight from Oskar Andreasson's famous iptables tutorial:

Thanks, that's got me started.
I'll have a look through that BIG tutorial.
It certainly looks as though it covers just about everything.
Thanks again.