0

I'm using this rules to slow down nmap scan

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A FORWARD -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP

It works well , but the port 8080 have big activity and I want to ignoe it in the hitcount. I want to have somethingn like that:

iptables -A INPUT -p tcp --dport!=8080 -i eth0 -m state --state NEW -m recent --set

Thanks

  • why are you trying to slow do a nmap scan? sound like security by obscurity to me. – The Unix Janitor Jul 17 '12 at 10:37
  • Yes it is . Is this a bad idea ? – isoman Jul 17 '12 at 10:47
  • so, what exactly are you trying to do? – The Unix Janitor Jul 17 '12 at 10:49
  • This rules work precfectly and i want to make an exception for some ports like 8080 . – isoman Jul 17 '12 at 10:51
  • you'll find that you will slow down legitimate traffic too. – The Unix Janitor Jul 17 '12 at 11:04
0

You can do this using either by writing your rules like:

iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP
iptables -A FORWARD -p tcp ! --dport 8080 -i eth0 -m state --state NEW -m recent --set
iptables -A FORWARD -p tcp ! --dport 8080 -i eth0 -m state --state NEW -m recent --update --seconds 30 --hitcount 10 -j DROP

or alternatively, you can add new rules for the excluded ports (BEFORE your rules):

iptables -A INPUT -p tcp --dport 8080 -i eth0 -m state --state NEW -j ACCEPT
iptables -A FORWARD -p tcp --dport 8080 -i eth0 -m state --state NEW -j ACCEPT

The second way will make it easier for you to add more exceptions.

  • so you think nmap doesn't scan on 8080 first? I.e it's in it's top port lists? – The Unix Janitor Jul 17 '12 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.