Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I often see that people set STEAL target in iptables rules. It's possible to get this target by installing (on debian) xtables-addons-common and xtables-addons-dkms. I was curious why people prefer STEAL over DROP, so I checked the manual, but there's only the following info:

   STEAL
       Like the DROP target, but does not throw an error like DROP when used
       in the OUTPUT chain.

Does anyone know what error? For example, we could take the two following rules:

-A OUTPUT --protocol tcp --match multiport ! --dports 80,443 --match set --match-set bt_level1 dst --jump STEAL

and:

-A OUTPUT --protocol tcp --match multiport ! --dports 80,443 --match set --match-set bt_level1 dst --jump DROP 

What is the difference between them?

share|improve this question

1 Answer 1

Drop sends an error packet when used with the OUTPUT chain. Kind of like how REJECT returns an error packet when used with the INPUT chain. STEAL doesn't.

EDIT: Per bahamat, the IPtables extensions are in fact done by the netfilter team.

share|improve this answer
1  
These extensions are provided by the netfilter team. They in fact write iptables and the kernel modules that go along with it. The code isn't outside because it's by untrusted party. It's because the code is experimental. –  bahamat Jan 17 at 17:44
    
Good to know, I was under the impression it was maintained by an outside group. –  rfelsburg Jan 17 at 17:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.