Archwiki features an article with suggestions for a stateful iptables firewall. They recommend some rules to trick port scanners, but advise that they open up a vulnerability for DoS attacks. In particular, by denying access to IPs that continuously try to access closed ports, a potential attacker could send these packets with a spoofed IP so that my firewall would lock out legitimate users.
The suggested TCP rules are as follows:
# iptables -I TCP -p tcp -m recent --update --rsource --seconds 60 --name TCP-PORTSCAN -j REJECT --reject-with tcp-reset
# iptables -A INPUT -p tcp -m recent --set --rsource --name TCP-PORTSCAN -j REJECT --reject-with tcp-reset
My question is, could I limit the effectiveness of said DoS attack if I add the packet's TTL to the rules? According to iptables' man page:
--rttl: [···] this will narrow the match to only happen when the address is in the list and the TTL of the current packet matches that of the packet which hit the --set rule. This may be useful if you have problems with people faking their source address in order to DoS you via this module by disallowing others access to your site by sending bogus packets to you.
Would it work or am I missing something?