Hiding Ports

Ozzman · 12-01-2003, 12:40 PM

i have every port on my system blocked except ssh and http and https, BUT all my other ports still come up when i run a port scan remotely, is there anyway to "hide" them completly so they dont even show up in a port scan? except for ssh http and https those are of course fine.

Thanks In Advance

fancypiper · 12-01-2003, 01:17 PM

portsentry?

unSpawn · 12-01-2003, 01:33 PM

From the LQ FAQ: Security references, about Iptables, please see Is "Stealth" important? as I think it applies to your case.

Fancypiper, a request if I may, would you be able to give a more verbose reply instead of just posting links?
If you want to talk about this you're invited to email me.
TIA.

Ozzman · 12-01-2003, 01:42 PM

Quote:

Originally posted by unSpawn
From the LQ FAQ: Security references, about Iptables, please see Is "Stealth" important? as I think it applies to your case.

Fancypiper, a request if I may, would you be able to give a more verbose reply instead of just posting links?
If you want to talk about this you're invited to email me.
TIA.

thanks, btw i found his post easily understandable, however i can see why you would rather him had at least wrote, check out this app. or something like that..

Thanks again, sorry for not just checking the sticky in the first place, im still a bit of a

to this site

unSpawn · 12-01-2003, 02:13 PM

sorry for not just checking the sticky in the first place
Np, np, that's why we try to promote it...

chrisfirestar · 12-02-2003, 09:20 PM

is this working now?

a couple of thigns... make the command DROP instead of DENY
also you have a few other ways of people "dicovering you" eg pings
so make sure you stop external pings

# Blocks External Ping requests
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all

and if you want to open it up later just type

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all

hope this helps

Ozzman · 12-05-2003, 04:32 PM

well i went ahead and installed it.. BUT it still isnt doing anything...

im running it in advanced tcp and udp mode, but i can still see the ports using my port scanner.. is there a special setting i need to set so it attaches itself to the firewall or anything like that?

Thanks again..

chrisfirestar · 12-07-2003, 08:43 PM

well u haven't actually said WHAT your using.. give us more info and we may be able to help.

My advice is only relevent if you are using IPTABLES really (except the ping stuff)

Ozzman · 12-08-2003, 05:08 AM

oh sorry about that.. im talking about

portsentry

and i am using Iptables, and those settings are already set..

chrisfirestar · 12-08-2003, 07:24 PM

are you clearing your iptables?

tell what you are trying to do and i will give you a firewall script to test ok