From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ryan Daly Subject: Re: making services invisible Date: 10 Oct 2002 09:25:28 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1034256328.549.41.camel@linux13.ctcgsc.org> References: <3DA57D10.8040904@bol.com.br> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="=-Dfc73hjCcLqiBciLkDAH" Return-path: In-Reply-To: <3DA57D10.8040904@bol.com.br> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Julio Cesar Ody , netfilter@lists.netfilter.org --=-Dfc73hjCcLqiBciLkDAH Content-Type: text/plain Content-Transfer-Encoding: 7bit Use DROP instead of REJECT. REJECT action tells tables to send back an ICMP message indicating that you're REJECTing the packet. DROPing will just DROP with no further action. -- On Thu, 2002-10-10 at 09:13, Julio Cesar Ody wrote: Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I blocked external acess to some services using the following rule: iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port ,, -j REJECT However, when I perform a stealth scan using nmap on my host, I still can see them running, but instead of "opened" I get them as "filtered". Is there a way to block these results, making the services literally invisible ? Appreciate any help, and also any technical information (links, docs) regarding the answer. Julio Cesar Ody --=-Dfc73hjCcLqiBciLkDAH Content-Type: text/html; charset=utf-8 Use DROP instead of REJECT.

REJECT action tells tables to send back an ICMP message indicating that you're REJECTing the packet. DROPing will just DROP with no further action.

--

On Thu, 2002-10-10 at 09:13, Julio Cesar Ody wrote:

Hello. I'm using Slackware 8.1, kernel 2.4.18 and iptables v1.2.7a. I 
blocked external acess to some services using the following rule:

iptables -A INPUT -i ! eth0 -p tcp -m multiport --destination-port 
<port1>,<port2>,<blablabla> -j REJECT

However, when I perform a stealth scan using nmap on my host, I still 
can see them running, but instead of "opened" I get them as "filtered". 
Is there a way to block these results, making the services literally 
invisible ? Appreciate any help, and also any technical information 
(links, docs) regarding the answer.



Julio Cesar Ody

--=-Dfc73hjCcLqiBciLkDAH--