how to configure firewall with "psad" utility to avoid port scan

Question

I am trying to configure psad to stop port scanning and other attacks.

Currently I have following rules set for my firewall which drops all incoming connection except port 22,80,443 and 3306.

 -A INPUT -j DROP

 -A FORWARD -j DROP

I want to use "psad". Major requirement mentioned by "psad" is " iptables policy to be compatible with psad is simply that iptables logs packets"

 iptables -A INPUT -j LOG
 iptables -A FORWARD -j LOG

So how do I configure my firewall rules?

1. Should I first log them and then drop them?

   -A INPUT -j LOG
   -A FORWARD -j LOG
   -A INPUT -j DROP
   -A FORWARD -j DROP
   

2. Should I not use drop at all? I am a bit skeptical of not dropping.

Answer 1

From the iptables manpage:

LOG
    Turn  on  kernel  logging of matching packets.  When this option is set
    for a rule, the Linux kernel will print some information on all  match-
    ing  packets  (like most IP header fields) via the kernel log (where it
    can be read with dmesg or syslogd(8)).  This is a "non-terminating tar-
    get",  i.e.  rule traversal continues at the next rule.  So if you want
    to LOG the packets you refuse, use two separate  rules  with  the  same
    matching criteria, first using target LOG then DROP (or REJECT).

"non-terminating" is the key terminology here. You can place LOG targets wherever you like, with the understanding that any target that "terminates" before the LOG entry will not be logged.

Answer 2

You need to structure your firewall rules intelligently. PSAD works by monitoring the log of connections to your system and then based on various heuristics makes a decision as to whether someone is scanning your system.

The LOG target is non terminating so once a packet has been logged it is passed back to the originating chain for further processing

Roughly you need to:

• Allow connections to 22,80,443 and 3306 without logging.
• Send everything else to the LOG target.
• There should be a default drop rule at the end and/or the policy should be drop.