fail2ban/fail2ban — pull request #215 by grooverdan (2013-05-05 05:51:28+00:00)
Title: ENH: add blocktype to all relevant actions. 

I changed the default the rejection to a ICMP reject rather than a drop. The basis of this is that a attacking host knows that the service/hosts exists so doing a DROP isn't hiding much. Also a drop also makes the client attempt a reconnect after their timeout. Sending a ICMP response isn't going to cause a DoS on the server and just informs the client that no connection is possible sooner.

Thoughts welcome. Happy to revert this back to a block and keep the blocktype as an option.