On 30/03/11 19:38, Thomas Bächler wrote:
You cannot "hide" yourself on the internet. If you were offline, the next router would reply that your machine is unreachable. By not answering, you not only tell the "attacker" that you are online, you also tell him that you don't know shit about networking.
Thank you for clearing that up :-) I always believed that remaining stealth, my machine was hidden on the internet from prying eyes. I was so mistaken !:-[
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
This properly rejects packets to your IP that are neither ICMP nor TCP nor UDP.
Sorry I confused packets with protocols. It basically tells that no http,pop3,ftp or imap services is running on my machine and politely closes the connection instead silently dropping the connection, right ?
And how does that harm you? It is rejected, and the sender now knows that he is sending to the wrong destination (instead of continuously retrying, which he would probably if you DROPped it).
It seems you were right. With my previous iptables configuration, i was getting thousands of unwanted packets from same sources multiple times. After using your configuration, there is a very sharp decrease of unwanted packets.