If the first packet of an UDP session is rejected by a security policy, what does the firewall send to the client?

UDP is a connectionless, stateless protocol with no built-in handshake mechanism, so there is no protocol-level way to signal rejection back to the sender in the same way TCP uses RST or FIN. When the firewall drops or rejects a UDP packet, it silently discards it, leaving the client to time out waiting for a response.

TCP FIN is a graceful connection termination signal specific to TCP sessions; it has no meaning for UDP traffic and cannot be sent in response to a UDP packet.

TCP RST is used to immediately terminate a TCP connection; it is not applicable to UDP sessions since there is no TCP connection to reset.

ICMP unreachable messages may be generated by routers for routing failures, but a security policy drop action on a UDP packet results in silent discard without sending any ICMP response.