Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Moving your SSH port isn’t security by obscurity. Parent comment
Because 99.99% of people out there use iptables, with a single default rule for unmatched packets, whether it be UDP or TCP.
> I don't know why to mention them in the firewall at all.
Because you surely don't want your hosts to expose something unexpected to the internet .
> The kernel knows which ports it is listening on, and drops the rest without prompting.
Nope, and that's precisely the subject of the discussion here. In case nothing is listening, you will receive a nice ICMP "port unavailable".
Is that the same (externally seen) effect as a REJECT?
Because 99.99% of people out there use iptables, with a single default rule for unmatched packets, whether it be UDP or TCP.
> I don't know why to mention them in the firewall at all.
Because you surely don't want your hosts to expose something unexpected to the internet .
> The kernel knows which ports it is listening on, and drops the rest without prompting.
Nope, and that's precisely the subject of the discussion here. In case nothing is listening, you will receive a nice ICMP "port unavailable".