Preventing port scanning

Preventing port scanning

[Stuart Lamble]

Hi All

Is it possible to prevent people from port scanning my firewall to see
whats open?


Thanks
Stu

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.654 / Virus Database: 419 - Release Date: 4/6/2004
 

Re: Preventing port scanning

[Antony Stone]

On Wednesday 07 April 2004 7:14 pm, Stuart Lamble wrote:

> Hi All
>
> Is it possible to prevent people from port scanning my firewall to see
> whats open?

<pedant>You can't prevent them port scanning your firewall, no,</pedant> 
however you can prevent them getting any positive answers simply by ensuring 
that all the ports are closed.

(If, for some reason, you need to have some ports open for external access to 
your network, then no, you cannot prevent people from discovering this.)

You might try using some sort of tarpit rules to bog down a naive port scanner 
which scans multiple ports in a short period of time, however these will have 
no effect on scanners which are only looking for a small number of ports 
(such as 21,22,23,25,53,80,110,119,143 for example).

Regards,

Antony.

-- 
Your work is both good and original.  Unfortunately the parts that are good 
aren't original, and the parts that are original aren't good.

 - Samuel Johnson

                                                     Please reply to the list;
                                                           please don't CC me.

RE: Preventing port scanning

[Rob Sterenborg]

> Is it possible to prevent people from port scanning my 
> firewall to see whats open?

You mean : "iptables -P INPUT DROP" ?


Gr,
Rob

Re: Preventing port scanning

[Antony Stone]

On Wednesday 07 April 2004 7:57 pm, Rob Sterenborg wrote:

> > Is it possible to prevent people from port scanning my
> > firewall to see whats open?
>
> You mean : "iptables -P INPUT DROP" ?

I'd recommend "iptables -F INPUT" with that choice, sir :)

Antony.

-- 
Most people have more than the average number of legs.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Preventing port scanning

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 954 bytes --]

* Antony Stone (Antony@Soft-Solutions.co.uk) wrote:
> On Wednesday 07 April 2004 7:14 pm, Stuart Lamble wrote:
> (If, for some reason, you need to have some ports open for external access to 
> your network, then no, you cannot prevent people from discovering this.)
> 
> You might try using some sort of tarpit rules to bog down a naive port scanner 
> which scans multiple ports in a short period of time, however these will have 
> no effect on scanners which are only looking for a small number of ports 
> (such as 21,22,23,25,53,80,110,119,143 for example).

It depends on what ports need to be open and what ports are being
scanned.  Using your example above and ipt_recent, if you don't have
port 21 open and the scan starts with that then you can drop the rest of
the attempted connections.  Of course, if the scanner is doing this
across a couple of hours or from many different IP addresses it gets
more difficult.

	Stephen

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Preventing port scanning

[Rob Sterenborg]

On Wed, 2004-04-07 at 21:09, Antony Stone wrote:
> On Wednesday 07 April 2004 7:57 pm, Rob Sterenborg wrote:
> 
> > > Is it possible to prevent people from port scanning my
> > > firewall to see whats open?
> >
> > You mean : "iptables -P INPUT DROP" ?
> 
> I'd recommend "iptables -F INPUT" with that choice, sir :)

Of course, where was my mind when I wrote this...
<grin>It's quite effective, however.</grin>


Gr,
Rob