Server 1:
is protected by iptables firewall.

Server 2:
is protected by Amazon Security Groups firewall.

Let's ping some BLOCKED(closed)(un-opened) port on both.

Server 1:

nc -w 1 <ip> <port>
Ncat: No route to host.

Server 2:

nc -w 1 <ip> <port>
Ncat: Connection timed out.

Why is there a difference ?

What is the difference between those two error messages ?
What does Amazon Firewall do differently.. Compared to
iptables firewall ?


Most likely, the AWS firewall is throwing back an ICMP packet indicating that the host cannot be found, while the iptables firewall is not reacting at all.

See https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Destination_unreachable.

The advantages of ICMP "unreachable" over just sending a TCP reset are:

  • it works the same way for UDP as well, which has no way to signal unwillingness to accept data
  • it is more honest in the AWS case because the packet is not coming from the host, but rather from AWS infrastructure; to generate a TCP reset, AWS would have to "forge" data on behalf of the protected host
  • some automated port scanners might give up without trying all ports if the host appears to be unreachable

"No Route To Host" means that your host could not figure out even how to reach the specified host. "Connection timed out" means that a route was found, but the remote host did not answer the request for a connection.

There are two ways a firewall typically will close off a port. One is to actually close it off - to set it to blocked. This will have the server actively refuse an incoming connection. This will, depending upon how you're testing, result in "No route to host", "Connection closed by foreign host", or similar messages received immediately upon trying to establish the connection.

The other way is to simply ignore incoming requests on the port. The supplicant never gets an answer, and the request times out. This is in some parlances called "stealth blocking" a port.

  • And this answers the question how? – DepressedDaniel Feb 16 '17 at 22:34

Quick answer, Firewall for Server 1 is rejecting the packets while firewall for server 2 is dropping them.

REJECT: Reject the packet and notify the sender that we did so, and stop processing rules in this chain.

DROP: Silently ignore the packet, and stop processing rules in this chain.

Server 1 (iptables) is rejecting the packet and replying back with an ICMP host unreachable message.

REJECT all -- anywhere anywhere reject-with icmp-host-unreachable

It says host unreachable like an upstream router while it implies the server is live and reachable because its IP address is still seen on the source IP of the reply packet.

This rule could be configured to simply reject with refusal:

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Server 2 (Amazon firewall) is dropping the packets, it causes the client to retry the connection until the threshold time is exceeded, then it generates the "Connection timed out" error message.

DROP all -- anywhere anywhere

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy