Home / server / Questions / 246225
In Process
Amirreza
Asked: 2011-03-12 06:30:36 +0800 CST

How can I use iptable rules to prevent port scanning like Hping and nmap?

  • 772

I want to add some rules to my iptables to prevent port scanning, how can I do this?
I find some solution but it's not efficient.

Port canning solution

iptables

2 Answers

  1. The best bet is having a default drop policy in iptables and then only allowing what's required. Something like:

    # Drop all packets by default.
iptables -P INPUT DROP
# Allow preexisting connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow SSH from 192.0.2.0/24
iptables -A INPUT -p tcp -s 192.0.2.0/24 --destination-port 22 -i eth0 -j ACCEPT
# Allow HTTP from all
iptables -A INPUT -p tcp --destination-port 80 -i eth0 -j ACCEPT

    It won't stop people from doing portscans, but it will mean that all they'll see is port 80 open.

    • 3

  2. For nmap port scanning, you can check the following answer: iptables Tips & Tricks

    I'm not familiar with Hping, but if Hping uses NULLflags, the answer I've linked above should also work.

    • 0