3 ms·
Imagine the case where you have an iptables rule for mysql, but don't currently have it running. This is the case that the author is referring to, whether or no
by keeperofdakeys 12y ago
Imagine the case where you have an iptables rule for mysql, but don't currently have it running. This is the case that the author is referring to, whether or not it's a blacklist or whitelist. The trick is getting the iptables response on drop/reject, and the OS response to no listening program to be the same.
- ckuehl 12y agoThe author is referring to the case where you use a blacklist to drop traffic to certain ports. Dropping traffic looks different than responding with a RST, which distinguishes that port (since all the others respond with an RST). But, if you instead have a default policy of "drop all incoming traffic", then it doesn't look weird that traffic to port 3306 is dropped, since traffic to all other ports is also dropped. More importantly, you also get the security benefit of using a whitelist rather than a blacklist.