> DROPping a UDP packet costs much less that REJECTing it. I cannot imagine why one would use REJECT for those. Because 99.99% of people out there use iptables

> DROPping a UDP packet costs much less that REJECTing it. I cannot imagine why one would use REJECT for those. Because 99.99% of people out there use iptables, with a single default rule for unmatched packets, whether it be UDP or TCP. > I don't know why to mention them in the firewall at all. Because you surely don't want your hosts to expose something unexpected to the internet . > The kernel knows which ports it is listening on, and drops the rest without prompting. Nope, and that's precisely the subject of the discussion here. In case nothing is listening, you will receive a nice ICMP "port unavailable".