Reject with Comment

When a single host on your network starts flooding a service and you need to shut it down fast, a targeted iptables REJECT rule is the cleanest option. Unlike DROP, which silently discards packets, REJECT sends a TCP reset back to the source so the connection attempt fails immediately and the client stops retrying.

The Command

iptables -I INPUT -j REJECT -p tcp --reject-with tcp-reset -m comment --comment "Probable flooding. Remove if a customer complains. Hebert" -s 192.168.1.101

What Each Part Does

• -I INPUT - Inserts the rule at the top of the INPUT chain so it is evaluated before any existing ACCEPT rules.
• -j REJECT - Sends a rejection response instead of silently dropping the packet.
• -p tcp --reject-with tcp-reset - Specifies that the rejection should be a TCP RST, which tells the client the connection was refused.
• -m comment --comment "..." - Attaches a human-readable note to the rule so anyone reading iptables -L -v later knows why it exists and who added it.
• -s 192.168.1.101 - Limits the rule to that single source IP, leaving all other traffic untouched.

Verifying the Rule

iptables -L INPUT -v -n | head -5

You should see the new rule at the top with your comment string and a packet counter starting at zero.

Removing the Rule

When the flooding stops (or a customer calls in), delete the rule by its position number:

iptables -D INPUT 1

Or, if you prefer matching on the comment:

iptables -D INPUT -j REJECT -p tcp --reject-with tcp-reset -m comment --comment "Probable flooding. Remove if a customer complains. Hebert" -s 192.168.1.101

Why REJECT Over DROP?

For a suspected flooding source, the immediate RST is the friendlier option for both your server and the client.

• Networking
• Security

• SysAdmin
• Bash