Preventing port scanning using iptables, is this possible?

sarajevo · 08-03-2006, 12:12 PM

Hi all,

I am hoping all of you had or having now summer holidays

. I wish you good time.
I had summer holiday and now am back to my job, and I am trying to make self made firewall using iptables. Personally I thing iptables is so powerful tool in linux world and I like it very much. But there is one think I can not realise and it is how prohibit port scanning on particular machine using iptables package. I mean is it possible to make some ports on machine do not response on port scanners like nmap and similar? Hipoteticaly I want to make some rules on firewall to make my system persistent on port scanning.

So if anybody out there know how to do this, or know right urls, books, or similar stuff, will help me a lot if write them down on this forum.

Thanks in advance.

Regards

Mara · 08-03-2006, 02:53 PM

Yes, it's possible. Simple -j DROP results in no response to a packet. Most scripts I know (and have written, too) use it as default for closed ports.

And an example code for SYN flood (also scan) protection:

Code:

SYN_LIMIT="5/s"
SYN_BURST="10"

$IPTABLES -A INPUT -p tcp --syn -m limit --limit $SYN_LIMIT --limit-burst $SYN_BURST -j ACCEPT
$IPTABLES -A INPUT -p tcp --syn -j WEHAVEASYNFLOOD

primo · 08-07-2006, 01:20 AM

There are 2 great tutorials at http://www.frozentux.net/

If you setup a firewall with a deny-by-default policy and stateful filtering, it's easy to prevent port scans. Make sure you DROP (instead of REJECT) those packets so your machine won't ellicit TCP RST's and ICMP DEST-UNREACH packets that give information on closed ports, thus slowing their scan. You may also temporarily block the offenders' IP's... Just make sure they aren't trying to block you from a known IP, though. I wouldn't recommend this option.

You may use sysctl's in addition to iptables.
See: /usr/src/linux/Documentation/networking/ip-sysctl.txt

Code:

# Note: SYN/FIN's are legitimate with T/TCP, though
# they may be used for TCP/IP OS fingerprinting, not a big deal anyway.
echo 1 > /proc/sys/net/ipv4/tcp_ignore_synfin

# TCP SYN flood protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Note: TCP Timestamps (RFC 1323) may disclose our uptime information
# but they're used to protect against wrapping sequence numbers.
# Enable it if you're using a fast connection
echo 0 > /proc/sys/net/ipv4/tcp_timestamps