Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using this rules to slow down nmap scan

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP

It works well , but the port 8080 have big activity and I want to ignoe it in the hitcount. I want to have somethingn like that:

iptables -A INPUT -p tcp --dport!=8080 -i eth0 -m state --state NEW -m recent --set

Thanks

share|improve this question
    
why are you trying to slow do a nmap scan? sound like security by obscurity to me. –  The Unix Janitor Jul 17 '12 at 10:37
    
Yes it is . Is this a bad idea ? –  isoman Jul 17 '12 at 10:47
    
so, what exactly are you trying to do? –  The Unix Janitor Jul 17 '12 at 10:49
    
This rules work precfectly and i want to make an exception for some ports like 8080 . –  isoman Jul 17 '12 at 10:51
    
you'll find that you will slow down legitimate traffic too. –  The Unix Janitor Jul 17 '12 at 11:04

1 Answer 1

up vote 0 down vote accepted

You can do this using either by writing your rules like:

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP
iptables -A FORWARD -p tcp ! --dport 8080 -i eth0 -m state --state NEW -m recent --set
iptables -A FORWARD -p tcp ! --dport 8080 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP

or alternatively, you can add new rules for the excluded ports (BEFORE your rules):

iptables -A INPUT -p tcp --dport 8080 -i eth0 -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp --dport 8080 -i eth0 -m state --state NEW -j ACCEPT

The second way will make it easier for you to add more exceptions.

share|improve this answer
    
so you think nmap doesn't scan on 8080 first? I.e it's in it's top port lists? –  The Unix Janitor Jul 17 '12 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.