Blocking TCP

robeb · 05-19-2002, 03:52 AM

Is there anyway to block TCP | SYN scans while keeping some ports open? For example, could you configure your firewall to tell the difference between a SYN scan packet and a SYN packet trying to establish a connection to your web server? I'm using IPTABLES in my script.

unSpawn · 05-19-2002, 06:24 AM

For example, could you configure your firewall to tell the difference between a SYN scan packet and a SYN packet trying to establish a connection to your web server?

If it's only got a SYN flag, then you can't, because there is no *difference* between a "scan" and a "regular" SYN packet. You can filter on having "malformed packets" aka weird combination of flags. This is the INVALID classification in Iptables' statefull packet filter (the conn_track gizmo).

crashmeister · 05-19-2002, 07:40 AM

Check out portsentry. That might be in the neighborhood of what you're looking for

unSpawn · 05-19-2002, 08:41 AM

Check out portsentry. That might be in the neighborhood of what you're looking for

Using Portsentry to block hosts by adding a null route or adding em to the fw script to block, what does "nmap -T insane -D ${lotsa_decoys} ${any_invalid_flags} ${your_host}" do?

*For ${lotsa_decoys} read linuxquestions.org, slashdot, wired, cnn, freshmeat, your border router, any linux vendor update uri, etc, etc you get it.