Mastering Linux Security and Hardening - Second Edition

Blocking everything that isn't allowed with iptables

To start blocking stuff that we don't want, we have to do one of two things. We can set a default DROP or REJECT policy for the INPUT chain, or we can leave the policy set to ACCEPT and create a DROP or REJECT rule at the end of the INPUT chain. Which one you choose is really a matter of preference. (Of course, before you choose one over the other, you might want to check your organization's policy manual to see if your employer has a preference.)

The difference between DROP and REJECT is that DROP blocks packets without sending any message back to the sender. REJECT blocks packets, and then sends a message back to the sender about why the packets were blocked. For our present purposes, ...