Should I block outbound TCP RST (on closed ports)?

Question

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I wonder, should I configure IPTABLES to silently drop these, so a scanner cannot so quickly learn the status of a port? If the volume was high, I would do so to avoid paying for the outbound bandwidth, but is there any reason other than that?

Answer 1

Whether you want to take the trouble to do this largely depends on your own threat model and the effort required to make the change.

The effect of filtering access to closed ports is that it makes it harder for someone foot-printing a network to establish potential attack targets.

Theoretically any information provided to an attacker is useful to them, so reducing the amount of information you provides improves your security.

There is also the potential risk that at some point your host might have an exploitable bug in its TCP/IP stack that could be exploited by a scanning host.

Whether any of that matters enough to you, as I say depends on your particular risk model. In general, I'd say that if it's easy to do, and has no other negative consequences, sure filter the traffic.

Answer 2

There is a number of reasons for allowing those RST packets to be send.

• If the clients are legitimate and found your IP address as only one of multiple IP addresses which could service them, then the RST will allow those clients to quickly move on to another address, which can service them. Filtering the RST packets could cause those clients to retransmit the SYN packet many times and consume more of your bandwidth than they would have if you allowed the RST packet to be send.
• If the clients are scanning your network for open ports, they will still be able to find out if there are any open ports, if they really want to. But just like the legitimate clients, they will need to use more of your bandwidth in order to achieve their goal if you filter RST packets.
• Packet filters make troubleshooting of network problems harder.
• If someone spoofs your IP address as part of an attack, you will make it easier for them to succeed in their attack by filtering RST packets.