Monday, 14 September 2009
Drop versus reject
« The house building process | Main | Gentoo versus Ubuntu »
Contemplating the firewall configuration of my home machine, it occurs to me that rejecting packets is likely more secure than dropping them (as to render more difficult IP spoofing).
Posted by at 10:22 PM in Tools and Programming
[Trackback URL for this entry]
Comment: at Tue, 15 Sep 2:16 PM
Proposed Summary: offers no effective barrier to hostile forces but can dramatically slow down applications run by legitimate users. DROP should not normally be used.
Comment: at Tue, 15 Sep 2:17 PM
From another blooog: Summary: DROP offers no effective barrier to hostile forces but can dramatically slow down applications run by legitimate users. DROP should not normally be used.
I think that it also helps to avoid timeout retries on some connections, so it generally helps performance.