LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 10-20-2017, 08:46 AM   #1
eshwars
LQ Newbie
 
Registered: Oct 2017
Posts: 2

Rep: Reputation: Disabled
Thumbs up HOW to VERIFY iptables port scan


Intention of this query is I badly needed testing the below iptables rules.
===================================================
I want to block port scan(tcp/udp) so that anyone doing port scan should be blocked for mu router gateway.
I have the following rules:

iptables -A INPUT -m recent --name portscan --rcheck --seconds 500 -j DROP
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 500 -j DROP

iptables -A INPUT -m recent --name portscan --remove
iptables -A FORWARD -m recent --name portscan --remove

iptables -A INPUT -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP
iptables -A FORWARD -p tcp -m tcp --dport 139 -m recent --name portscan --set -j DROP

But I badly need of testing the above rules.
I tried with nmap but same result is getting for enable and disable for this port scan. output of nmap is below:

[root@xconf technicolor]# nmap 192.168.5.177
Starting Nmap 6.40 ( http://nmap.org ) at 2017-10-12 07:30 EDT
Nmap scan report for 192.168.5.177
Host is up (0.020s latency).
Not shown: 994 filtered ports
PORT STATE SERVICE
20/tcp closed ftp-data
21/tcp closed ftp
22/tcp closed ssh
161/tcp closed snmp
990/tcp closed ftps
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 17.87 seconds

Appreciate a helping hand.Thank you in advance.

Last edited by eshwars; 10-20-2017 at 08:53 AM.
 
Old 10-20-2017, 09:26 PM   #2
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
How are you populating the portscan DB? Are you using the '--set' option anywhere? Without the set nothing is placed into the portscan DB thus you have nothing to match against.
 
Old 10-21-2017, 08:39 PM   #3
eshwars
LQ Newbie
 
Registered: Oct 2017
Posts: 2

Original Poster
Rep: Reputation: Disabled
Hi
I did not use any set commands. can you please give syntax for set.
can you explain about the options used i.e ---recent and --rcheck from the above rules.

Last edited by eshwars; 10-21-2017 at 08:42 PM. Reason: typo
 
Old 10-23-2017, 08:08 AM   #4
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
You can look through here and if you still have issues let me know.

IPTALBES RECENT SETUP
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Port scan shows some ports as closed, others as stealth when using reject in iptables Ormu Linux - Networking 7 11-28-2015 12:05 PM
iptables / scan port secrets88 Linux - Server 1 07-02-2015 02:24 PM
iptables port scan jindalarpan Linux - Security 3 07-17-2013 08:52 AM
iptables and port scan Ammad Linux - Security 2 06-12-2007 03:11 PM
Port Scan Detectors for IPTables Artimus Linux - Security 3 03-03-2003 04:57 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration