Re: Defeating NMAP Null scans (and Nessus scans).

["Taylor, Grant" <gtaylor@riverviewtech.net>]

> Does it really? What if there happens to be a null-flags/xmas-flags tcp packet 
> in an otherwise well-behaved tcp connection? I'd guess it would match 
> ESTABLISHED, even if it has got null flags.

As I understand it it is not possible to have the same packet be part of a null AND xmas scan as they are the exact opposite of each other acting on the SAME flags.

As far as not having the ESTABLISHED or RELATED state allowing the scan packets through you would want to have something like this first, before our stateful rule:

# Drop any XMas scan packets.
iptables -t filter -A FORWARD -i $INet -o $LAN -p tcp --tcp-flags ALL ALL -j DROP

# Drop any Null scan packets.
iptables -t filter -A FORWARD -i $INet -o $LAN -p tcp --tcp-flags ALL NONE -j DROP

# We could put any matches for any other type of scan that we wanted to here too.


# Allow any stateful traffic back in.
iptables -t filter -A FORWARD -i $INet -o $LAN -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow any normal LAN traffic out.
# Note:  We should probably do some validity checking here but we will not for simplicity.
iptables -t filter -A FORWARD -i $LAN -o $INet -j ACCEPT

You would probably want to do a corresponding drop in the INPUT chain too.