QuestionAccepted answer
Iptables --reject-with tcp-reset for non-TCP traffic
red0ct
10 Mar 2021, 12:46 UTC
33.8K views1
Here I faced with a bit strange rule:
iptables -A INPUT -s 10.26.95.20 -j REJECT --reject-with tcp-reset
This rule matches all the protocols from specific network and rejects it with TCP RST packet.
How is this supposed to work with non-TCP packets? If other end (10.26.95.20) sends UDP packet it then receives TCP RST? This looks extremely strange..
linux1 answer
Accepted answer · original discussion
parkamark
Permalink12 Mar 2021, 12:46 UTC
Yeah, it makes no sense. IPTABLES also errors when I attempt to issue this on the command line (tested on CentoOS 8). It can only work if -p tcp is given which specifies that the rule is dealing with TCP traffic. Then it will work.
1 question comment
Use comments to ask for clarification. Post a solution as an answer.
dave58Permalink
14 Mar 2021, 12:46 UTC
For anyone looking at this 2021 question: It looks like the cited website has been corrected and no longer has the issue. It now shows four REJECT scenarios: iptables -A INPUT -s 10.26.95.20 -j REJECT --reject-with tcp-reset , iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset , iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable , and iptables -A INPUT -j REJECT --reject-with icmp-proto-unreach