REJECT instead of DROP to avoid TCP retries.