Re: [exim] Deny vs. Drop

Top Page
Delete this message
Reply to this message
Author: Jakob Hirsch
Date:  
To: Daniel
CC: exim-users
Subject: Re: [exim] Deny vs. Drop
Quoting Daniel:

> incomming connections, and REJECT outgoing connections. DROP will send
> the packet to nowhere making you somewhat invisible and make the
> initiating connection wait and wait (this is good) However, you should


No, that's security by obscurity, which is not good and its careless use
have lead to problems like the infamous clamp-mss hacks.
Instead of simple blackholing, one should rate-limit icmp-unreachable
and tcp rst, multi-level if possible, e.g. low per-IP limit and higher
overall limit.