Need support for REJECT target and --reject-with types

[kbielefe]

As far as I can tell, python-iptables does not currently support the REJECT target and the --reject-with types:

• icmp-net-unreachable
• icmp-host-unreachable
• icmp-port-unreachable
• icmp-proto-unreachable
• icmp-net-prohibited
• icmp-host-prohibited
• icmp-admin-prohibited

These targets are important for many firewall applications. We are willing to submit a pull request for this if someone is not already working on it.

[kbielefe]

Never mind. Figured out the documentation.

[ldx]

@kbielefe out of curiousity, did you have to change anything in your code to make this work?

[kbielefe]

I did it like below. It seems straightforward enough, once you know what to look for. "REJECT" by itself works just with create_target, but defaults to icmp-net-unreachable, which makes web browsers retry for a minute or so. icmp-host-prohibited makes them give up right away, which is what we needed for our application.

target = iptc.Target(rule, "REJECT")
target.reject_with = "icmp-host-prohibited"