drop stays silent, and the client waits. See what reject changes. "Start" puts the drop rule back.
A refusal instead of silence
In /opt/packets-lab/rules.nft replace the drop action with reject and load the file on lab-node2. Look at six packets exchanged with 192.0.2.11, then request the site from lab-node1.
First, predict
What will lab-node2 send back to a SYN for port 8080 once the rule says reject?
Now start the exercise, run the command and compare your prediction with the output.
The refusal comes at once, but there are two kinds of it.
By default a reject rule answers with an ICMP "port unreachable" message: ICMP 192.0.2.12 tcp port 8080 unreachable. Port 8081 is closed by the kernel: nobody listens there, and the kernel answers with an RST packet — Flags [R.]. A reject with tcp reset rule sends the same RST, and the packets cannot tell it from an empty port: on the server ss -ltn and nft list ruleset can.
The client sees no difference: curl prints Couldn't connect to server in both cases, nc prints Connection refused.
| On the server | In tcpdump | At the client |
|---|---|---|
drop |
[S] and its repeats, no reply |
a timeout |
reject |
[S], then ICMP … unreachable |
an instant refusal |
an empty port, reject with tcp reset |
[S], then [R.] |
an instant refusal |
| an open port | [S], [S.], [.] |
a connection |
The filter tcp port 8080 hides the ICMP reply: it is not a TCP packet. With that filter a reject refusal looks like a SYN with no reply, only without repeats. Look at refusals with an address filter — host 192.0.2.11.
The client gets Couldn't connect to server at once, and tcpdump on the server shows the line ICMP … tcp port 8080 unreachable after the SYN. Who refused?
-
The client's SYN reached the server — it is in the output, and the reply came from
192.0.2.12. -
dropsends nothing back: the client repeats its SYN and waits until the timeout. -
The kernel closes an empty port with an
[R.]packet from192.0.2.12.8080. The ICMP message came from therejectrule.
An ICMP "port unreachable" message in reply to a SYN comes from a reject rule. An empty port and reject with tcp reset answer with [R.], and drop with silence.