3

From a Trustwave report, we are trying to set our server to block this type of request but after trying several combinations of rules, we can still see the ports.

Could anyone give me a hint or the set of necessary rules to block this request?

I'm using nmap --scanflags SYN,FIN xxx.xxx.xxx.xxx to test if iptables is blocking or not.

1
  • This should be on by default, but just in case check you have syn cookies enabled with sysctl net.ipv4.tcp_syncookies. Apr 26, 2011 at 22:06

4 Answers 4

3

This rule will match if the syn flag is set

iptables -A BLOCK -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP

And this one will match for the FIN flag

iptables -A BLOCK -p tcp --tcp-flags SYN,ACK,FIN,RST FIN -j DROP

note that you will need to tweak this as the syn rule will prevent incoming tcp connections at all for your device, perhaps set the specific port you want blocked?

1
2

I use something to prevent this SYN attacks. Not sure if it is correct one for your case but you may take a look. I count requests per second and block IPs with more than X (in my case 20) requests in 1 second. Works for me.

iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 1 --hitcount 20 -j DROP
1

Go check my Community Wiki: iptables Tips & Tricks

Especially the following "answer": Answer #245713

Please note that for the blockage to be effective, it must be placed in -t raw -A PREROUTING

0

There is a document entitled "Detecting and deceiving network scans" on the net, which goes into this with analytical detail, and finds the optimal blocking parameters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .