Firewall does not accept REJECT

Software SW help
1

I have the default policy in the Network / Firewall / section set to DROP.

I changed to REJECT:

FW

but Status / Firewall still shows DROP:

Status

Via CLI: iptables -S also shows -P INPUT DROP

CLI command: iptables -P INPUT REJECT returns iptables: Bad policy name. Run dmesg 'for more information`

iptables -P INPUT ACCEPT
iptables -P INPUT DROP
works correctly
Why only REJECT doesn’t work?

Firewall and TO reboots completed.
Tested on TO 5.1.9

1 Like
2

reject can not be used as a chain policy.

http://lists.netfilter.org/pipermail/netfilter/2003-March/043187.html

1 Like
3

Thanks for the clarification!
I thought my firewall was broken :wink:

But that means LUCI is misleading.
This is confusing and the REJECT option should not be visible in the settings :frowning:
policy_reject

4

Can I still ask you for help, where is the best place to add my own rules to block incoming traffic from the Internet?

I would like to add for example:
-A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j LOG
-A INPUT -p tcp ! --syn -m conntrack --ctstate NEW -j DROP (or -j RETURN)

Add to main chain INPUT or input_rule or input_wan_rule or to zone_wan_input ?

5

why not stay with the equivalent

config zone
    option name 'wan'
    list network 'wan'
    list network 'wan6'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'
6

Because:

  1. It was just an example and I want to make my -j LOG rules more detailed.
  2. I don’t want REJECT, I prefer DROP (prefer not to have to respond to floods of scans).
7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.