I'm working with iptables in order to close one or two open ports.

So I tried this rule in order to change the default policy.

# iptables -A INPUT -p tcp --dport 3333 -j DROP

Then I checked the policy using iptables -L -n -v where it showed the port which was dropped.

I don't have a basic understanding on how does the DROP rule works? Any help would be appreciated.

  • 1
    When a packet is dropped, no reply is sent to sender. The sender doesn't know if the destination IP or port exists or not. When REJECTin a packet, the sender receives a reply that the packet was rejected. DROP'ing is thus more stealthier. Commented Jan 10, 2015 at 11:36

1 Answer 1


First off, you said you intended to change the default policy, and the command you provided (-A)ppends the rule, leaving the default ACCEPT in place. If you want to change default policy use the following: iptables -D INPUT DROP

Secondly, there are 3 types of action iptables can take when parsing a packet:

ACCEPT - allow packet to continue as intended.

REJECT - block the packet from moving forward, send an ICMP message back stating that the connection was rejected.

DROP - diacard the packet completely with no notification

Rejecting rule is useful when you want to know that the packet reached the iptables layer and was discarded (which can be helpful when debugging the firewall). It is arguably more secure to use DROP, as in the real world scenario, as the attacker would not get any information on the state of the system ports.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .