ufw Linux firewall difference between reject and deny -

using uncomplicated firewall ufw, can set ports/services reject , deny.

for example:

ufw deny www  ufw reject www 

can explain me difference between 2 approaches?

"deny" uses drop iptables target, silently discards incoming packets.

"reject" uses reject iptables target, sends error packet sender of rejected packet.

from ufw manual page:

sometimes desirable let sender know when traffic being denied, rather ignoring it. in these cases, use reject instead of deny.

from point of view of user/program trying connect server:

• "deny" keep program waiting until connection attempt times out, short time later.

• "reject" produce immediate , informative "connection refused" message.

edit:

from security point of view "deny" slightly preferrable. force every connection potential attacker time-out, slowing down probing of server.

experienced and/or determined attackers won't affected - patient , there several ways deal slow down, anyway. might discourage occasional wannabe did not bother read nmap manual page, though.

"deny" save bit of bandwidth on uplink not sending error packet. might important on asymmetric network connections dos attack saturate - narrower - uplink error packets.

on other hand, bit more polite let people know rejecting connections. refused connection lets people know permanent policy decision, rather e.g. short-term networking issue.