I think I finally understand the problem. Main misunderstanding of me (and I suppose some others) was I suggested that a scanner is somewhere outside.
If you plan to use this host as a scanner than iptables may be really overwhelmed.
If so, you need some setup protecting host applications but not creating session records for the scanner traffic.
The solution is simple: create a container (LXC or OpenVZ) and hide your scanner staff there. Use a bridged connection setup of your container to the real network.
Thus your scanner will have a dedicated IP address and host applications will never bind It. In basic setup container's traffic will skip iptables.
If you want to additionally protect the container, turn on iptable lookup for the bridge (net.bridge.bridge-nf-call-iptables = 1
in sysctl.conf) and add the rules as follow:
-I FORWARD -p ip -s <rogue_network> -d <scanner_ip> -j ACCEPT
-I FORWARD -p ip -s <scanner_ip> -d <rogue_network> -j ACCEPT
-I FORWARD -j REJECT --reject-with icmp-host-unreachable
UPD:
Previous is not working properly - forget to disable connection tracking:
-t raw -I PREROUTING -p ip -s <rogue_network> -d <scanner_ip> -j NOTRACK
-t raw -I PREROUTING -p ip -s <scanner_ip> -d <rogue_network> -j NOTRACK
-t raw -I PREROUTING -j REJECT --reject-with icmp-host-unreachable
iptables
would be much the easiest way to do this; why can you not use it?iptables
firewall set to send TCP resets to NEW inbound connections will differ from simply having no listening daemon, and the kernel sending TCP resets?