Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I want to add some rules to my iptables to prevent port scanning, how can I do this?
I find some solution but it's not efficient.

Port canning solution

share|improve this question

2 Answers

up vote 1 down vote

The best bet is having a default drop policy in iptables and then only allowing what's required. Something like:

# Drop all packets by default.
iptables -P INPUT DROP
# Allow preexisting connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow SSH from 192.0.2.0/24
iptables -A INPUT -p tcp -s 192.0.2.0/24 --destination-port 22 -i eth0 -j ACCEPT
# Allow HTTP from all
iptables -A INPUT -p tcp --destination-port 80 -i eth0 -j ACCEPT

It won't stop people from doing portscans, but it will mean that all they'll see is port 80 open.

share|improve this answer
it didn't that do what I want :(, your solution force me to open specific ports – Amirreza Mar 12 '11 at 5:24
There's no way to block port scans specifically without blocking legitimate traffic. All you can do is make sure that as little as possible is open to the public and that it's well secured. The above script does a default "DROP" rather than "REJECT". A "REJECT" would tell the port scanner that the port is closed straight away. The DROP wastes their time by making the scanner have to waste a certain amount of time before moving onto another port. – Niall Donegan Mar 12 '11 at 12:05
up vote 0 down vote

For nmap port scanning, you can check the following answer: iptables Tips & Tricks

I'm not familiar with Hping, but if Hping uses NULLflags, the answer I've linked above should also work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.