Block nmap xmas scan from detecting my server's open port

Question

I have blocked all the basic nmap scans using iptables by making a rule in the INPUT chain that if the no of packet send from a particular ip within 10 seconds exceeds a particular limit then put that ip in blacklist and deny the further packets. This way the nmap SYN Stealth Attack, SYN connect, UDP and all other basic scans are blocked Now I want to block nmap xmas scan. Can somebody tell me how to do that.

I have written the following rules:

$ iptables -A INPUT -m state --state NEW -m recent --set --name NEW
$ iptables -A INPUT -m recent --update --seconds 10 --hitcount 5 --rttl --name NEW -j DROP

Thanks in advance

Answer 1

Can you be more specific about the rule that you've configured?

As you've described it, it would block an X-mas scan; a packet lit up with flags like a Christmas tree would still be a packet "sent from a particular IP" - but if that's truly how you've set up your rules, then you're likely going to unintentionally ban hosts sending legitimate traffic at a rate that violates the rule.

Don't put a lot of effort into security by obscurity. You service is open to the internet, and a scanner can simply slow their scan rate to a crawl to defeat your rate limit, or they can randomly hit the open port before the block kicks in. Blocking scans is not a substitute for securing your service.