# \[IPTABLES\] - difference between DROP and REJECT? **URL:** \ **Category:** Network and Wireless Configuration\ **Created:** [May 24, 2020, 10:38am UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738 "2020-05-24T10:38:15Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![czezz](https://forum.openwrt.org/letter_avatar/czezz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czezz](https://forum.openwrt.org/u/czezz)\ **Post date:** [May 24, 2020, 10:38am UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/1 "2020-05-24T10:38:15Z")
By setting target/port as **DROP** , I still can reach service/port with netcat: ``` #Deny snmpd on WAN config rule option name Deny-snmpd-WAN option target DROP option src wan option dest_port 161 option proto udp option family ipv4 $ nc -vuz My-Public-IP 161 Connection to My-Public-IP 161 port [udp/snmp] succeeded! ``` However, snmpwalk (in this particular situation i used 161) gets time out. ``` $ snmpwalk -v 1 -c public My-Public-IP 1.3.6.1.2.1.1 Timeout: No Response from My-Public-IP ``` Only when I set target as **REJECT** , port seems to be really blocked. (netcat returns no value) `option target REJECT` **Question:** whats the difference between DROP and REJECT? ---
**Author:** ![pwned](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pwned/32/29505_2.png) [@pwned](https://forum.openwrt.org/u/pwned)\ **Post date:** [May 24, 2020, 10:50am UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/2 "2020-05-24T10:50:23Z")
reject = let the remote station know that traffic is denied on target --\> netcat is getting a value back. drop = the traffic is just blocked on target --\> netcat isn't getting any feedback from target. There are a lot of discussions on www what is "better". Just ask the www. 😉 If you are unsure choose reject. ---
**Author:** ![czezz](https://forum.openwrt.org/letter_avatar/czezz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czezz](https://forum.openwrt.org/u/czezz)\ **Post date:** [May 24, 2020, 6:36pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/3 "2020-05-24T18:36:39Z")
To me it looks like exactly opposite 😉 DROP --\> netcat is getting a value back REJECT --\> netcat isn't getting any feedback from target Thanks for your reply and appreciate for looking at this topic 🙂 ---
**Author:** ![hnyman](https://forum.openwrt.org/user_avatar/forum.openwrt.org/hnyman/32/19_2.png) [@hnyman](https://forum.openwrt.org/u/hnyman)\ **Post date:** [May 24, 2020, 6:54pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/4 "2020-05-24T18:54:18Z")
> [@czezz](#): > > `Connection to My-Public-IP 161 port [udp/snmp] succeeded!` Did you make the connection to your WAN port from outside your network, or from inside? If from inside, then it might be that NAT reflection rules pay a role in your results (as you specify `option src wan` ). ---
**Author:** ![pwned](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pwned/32/29505_2.png) [@pwned](https://forum.openwrt.org/u/pwned)\ **Post date:** [May 24, 2020, 8:04pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/5 "2020-05-24T20:04:35Z")
> [@czezz](#): > > To me it looks like exactly opposite 😉 > DROP --\> netcat is getting a value back > REJECT --\> netcat isn't getting any feedback from target > > Thanks for your reply and appreciate for looking at this topic 🙂 Sorry, I didn't pay attention to your specific result here. My answer was more general. And I was not expecting the cirumstence that you made probably a typical error in testing ports. You have to test form outside. E. g. https\_://www.yougetsignal.com/tools/open-ports/ But be carefull. Not every ISP like those things and may block sites scanning ports on their network. As an alternative you could use your Smartphone also (installed a shell) and scan for specific ports if they are reachable. ---
**Author:** ![Mongolo](https://forum.openwrt.org/user_avatar/forum.openwrt.org/mongolo/32/21137_2.png) [@Mongolo](https://forum.openwrt.org/u/Mongolo)\ **Post date:** [May 24, 2020, 8:19pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/6 "2020-05-24T20:19:27Z")
[![](https://i.ytimg.com/vi/wlV9R9d1Bac/maxresdefault.jpg "LEDE / OpenWRT Stealth Router Ports") ](https://www.youtube.com/watch?v=wlV9R9d1Bac) Link: - [GRC | ShieldsUP! — Internet Vulnerability Profiling](https://www.grc.com/shieldsup) ---
**Author:** ![czezz](https://forum.openwrt.org/letter_avatar/czezz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czezz](https://forum.openwrt.org/u/czezz)\ **Post date:** [May 26, 2020, 7:26am UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/7 "2020-05-26T07:26:58Z")
To me this scanner smells like a fake. I have non NetBios/SMB service installed on my OpenWRT box. Also, I have other ports that are OPENED but are not mentioned here. ![test](https://forum.openwrt.org/uploads/default/original/3X/2/6/26cf489e70c62733828e2c2f31502a3d42fb79e8.jpeg) ---
**Author:** ![hnyman](https://forum.openwrt.org/user_avatar/forum.openwrt.org/hnyman/32/19_2.png) [@hnyman](https://forum.openwrt.org/u/hnyman)\ **Post date:** [May 26, 2020, 9:00am UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/8 "2020-05-26T09:00:00Z")
The scanner does not try to figure out the actual service, but just names the ports by the typical/reserved service usage. Additionally, consumer ISPs typically block some vulnerable/attacked ports, so it is quite possible that some ports that you think as open, are not open for users in internet. ---
**Author:** ![pwned](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pwned/32/29505_2.png) [@pwned](https://forum.openwrt.org/u/pwned)\ **Post date:** [May 26, 2020, 11:45am UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/9 "2020-05-26T11:45:35Z")
If you want it more precise: - Use your smartphone as a gateway and scan your ip from outside with your linux toolchain. - Use a 5$ root-shell/-vserver and scan your ip ... - Get more router hardware to scan devices from inside your lan ... - By default there are no open ports (beside the necessary) on OpenWrt. So port 161/162 should not be open by default anyway. So no smmp traffic should reach your lan. ---
**Author:** ![czezz](https://forum.openwrt.org/letter_avatar/czezz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czezz](https://forum.openwrt.org/u/czezz)\ **Post date:** [May 26, 2020, 1:37pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/10 "2020-05-26T13:37:41Z")
> [@pwned](#): > > By default there are no open ports (beside the necessary) on OpenWrt. So port 161/162 should not be open by default anyway. So no smmp traffic should reach your lan. A.... this one is not true. I had to add following rule to block 161 on WAN interface ```plaintext #Deny snmpd on WAN config rule option name Deny-snmpd-WAN option target REJECT option src wan option dest_port 161 option proto udp option family ipv4 ``` ---
**Author:** ![krazeh](https://forum.openwrt.org/user_avatar/forum.openwrt.org/krazeh/32/21639_2.png) [@krazeh](https://forum.openwrt.org/u/krazeh)\ **Post date:** [May 26, 2020, 2:08pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/11 "2020-05-26T14:08:10Z")
> [@czezz](#): > > A.... this one is not true. > I had to add following rule to block 161 on WAN interface If you've had to add a rule to block it then you've either previously changed the default firewall rules or added a rule allowing input to port 161. ---
**Author:** ![pwned](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pwned/32/29505_2.png) [@pwned](https://forum.openwrt.org/u/pwned)\ **Post date:** [May 26, 2020, 2:08pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/12 "2020-05-26T14:08:39Z")
How did you know that if you can't verify it? For me nmap shows on my boxes: 161/udp closed, 162/udp closed. For reference: nmap -sU -p 161 Router-IP. So you have actively installed software on your box which opened this ports by default or you did it by yourself. ---
**Author:** ![czezz](https://forum.openwrt.org/letter_avatar/czezz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czezz](https://forum.openwrt.org/u/czezz)\ **Post date:** [May 26, 2020, 3:26pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/13 "2020-05-26T15:26:07Z")
Look at my first post. I did netcat to my OpenWRT on port 161 on WAN interface. ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 26, 2020, 3:34pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/14 "2020-05-26T15:34:29Z")
Where was the host running the netcat located? In your LAN or in the WAN/Internet? ---
**Author:** ![czezz](https://forum.openwrt.org/letter_avatar/czezz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czezz](https://forum.openwrt.org/u/czezz)\ **Post date:** [May 26, 2020, 3:39pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/15 "2020-05-26T15:39:03Z")
WAN/Internet obviously ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 26, 2020, 3:57pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/16 "2020-05-26T15:57:38Z")
I just tried it on my router. With Reject nc is reporting Connection Refused. With Drop nc is reporting open. Bottom line, nc is misleading you. ---
**Author:** ![pwned](https://forum.openwrt.org/user_avatar/forum.openwrt.org/pwned/32/29505_2.png) [@pwned](https://forum.openwrt.org/u/pwned)\ **Post date:** [May 26, 2020, 4:12pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/17 "2020-05-26T16:12:25Z")
> [@czezz](#): > > Look at my first post. > I did netcat to my OpenWRT on port 161 on WAN interface. You are not providing qualified information. How did you test? Our guess above was (because you had exactly the opposite result of what you can expect if you test correctly) that you were testing the wan-side from a machine connected to the lan-side of the router you are testing. This is wrong and can never give any valid result. You never disagreed this guess and insisting on your result only with "read post #1". That in connection with default settings of OpenWrt makes me sure that you are wrong with your diagnose. That said I'm out of this discussion. 🙂 ---
**Author:** ![czezz](https://forum.openwrt.org/letter_avatar/czezz/32/5_5575768a8748004e209b776fc1b2916d.png) [@czezz](https://forum.openwrt.org/u/czezz)\ **Post date:** [May 26, 2020, 5:21pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/18 "2020-05-26T17:21:18Z")
Ya, Im testing my WAN interface from external/internet host. Im actually surprised that anyone would test WAN interface the other way (from LAN) 😃 Anyway, appreciate for your replies guys 🙂 ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [May 26, 2020, 6:40pm UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/19 "2020-05-26T18:40:54Z")
> [@czezz](#): > > Im actually surprised that anyone would test WAN interface the other way (from LAN) You haven't been around too long I guess 😛 ---
**Author:** ![system32](https://forum.openwrt.org/letter_avatar/system32/32/5_5575768a8748004e209b776fc1b2916d.png) [@system32](https://forum.openwrt.org/u/system32)\ **Post date:** [May 30, 2020, 9:23am UTC](https://forum.openwrt.org/t/iptables-difference-between-drop-and-reject/64738/20 "2020-05-30T09:23:52Z")
In my experience with nftables reject with tcp reset -\> nmap reports nothing (same as no listener bound to port) drop -\> nmap reports "filtered" There is lots of discussion on www which is better. reject sends a packet back drop does not respond, the client may try a few more times