[Fedora] Re: iptables: drop or reject?

[Tim]

On Thu, 2007-10-25 at 12:27 -0600, Ashley M. Kirchner wrote:
>     This all started because a few days ago I started getting 3
> servers that are in the Hurricane Electric network sending a ton of
> spam e-mails to invalid user names on my network.  Ever since I
> started dropping their packets, the flow of activity from those 3
> machines increased dramatically.  What used to be just a few packets
> every minute has now gone to some 5 to 10 packets being dropped every
> second.
> 
>     E-Mails to them is simply being ignored...at least, I have yet to 
> hear anything back or to see a change. 

Is that a place that you can phone?  It may have better results to
actually talk to someone about a problem emanating from their network,
they may not have noticed the problem, especially if they pay no
attention to abuse reports or system logs.

Whether it's best to reject or ignore is hard to quantify.

If the remote end worked in a proper networking manner, a rejection
means cease and desist.  No further attempts should be made, and that
ought to be automatic (at their side of things).  Whereas an ignore
might be taken as a networking issue that might resolve itself in a
little while, so keep on trying, perhaps altering the route.

A reject also helps against genuine mistakes.  Someone else setting up
their network, but getting an address slightly wrong will get an instant
response, and stands a better chance of fixing their problem, quickly.

But abusers, on the other hand, are virtually impossible to predict.
They may well continue to keep trying, no matter what.  I don't think
you're giving too much away by telling them to go away, rather than
pretending you're not home.  They'll just hammer away at whatever
addresses they have until they change their attack list.  You could try
both responses, at different times, and see if it makes any difference.

You've got more than one thing to consider.  Whether there's any
difference in your outgoing traffic by responding that's worth worrying
about (e.g. daily/monthly quotas).  Whether the firewall is keeping
track of a lot of things, or not.

You could try an approach that tries a few rejects, then ignores them if
they don't pay attention to your reject.  That ought to be nice to those
accidentally connecting, and also be turning your back on those that
aren't.

-- 
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.