Menu
Using the uncomplicated firewall ufw, I can set ports/services to reject and deny.
For example:
ufw deny www
ufw reject www
Can someone explain to me the difference between the two approaches?
656
Both deny and reject are intended to block traffic. The difference is that when the value is deny, traffic will be blocked without response, and if the value is reject, traffic will be blocked with a response message Destination host unreachable.
Sending port unreachable ICMP messages in response to a TCP packet (as REJECT does) is useless and is disregarded by many protocol stacks. A viable option is to use DENY, which sends no reply. Alternatively you can use a package such as return-rst in conjunction with ipchains to produce the correct response.
The allow and deny subcommands for ufw are used to implement firewall policies. If we want to allow incoming SSH connections we can simply say: $ ufw allow 22. If we want we can explicitly state whether the allow rule is for incoming (ingress) or outgoing (egress).
Or if you want to deny all connections from 203.0. 113.4 you could use this command: sudo ufw deny from 203.0. 113.4.
"deny" uses the DROP iptables target, which silently discards incoming packets.
"reject" uses the REJECT iptables target, which sends back an error packet to the sender of the rejected packet.
From the ufw manual page:
Sometimes it is desirable to let the sender know when traffic is being denied, rather than simply ignoring it. In these cases, use reject instead of deny.
From the point of view of the user/program that is trying to connect to your server:
"deny" will keep the program waiting until the connection attempt times out, some short time later.
"reject" will produce an immediate and very informative "Connection refused" message.
EDIT:
From a security point of view "deny" is slightly preferrable. It will force every connection from a potential attacker to time-out, thus slowing down the probing of your server.
Experienced and/or determined attackers won't be really affected - they are usually patient and there are several ways to deal with the slow down, anyway. It might discourage the occasional wannabe that did not even bother to read the nmap manual page, though.
"deny" will also save a bit of bandwidth on the uplink by not sending the error packet. This might be important on asymmetric network connections where a DoS attack could simply saturate the - usually narrower - uplink with error packets.
On the other hand, it is a bit more polite to let people know that you are rejecting their connections. A refused connection lets people know that it is most probably a permanent policy decision, rather than e.g. a short-term networking issue.
71
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
