Brent Clark schrieb: > Hi all > > I got tips for nmap blocking from someone on this list. > Im trying to log the problems that logged. > Would anyone care to recheck my rulset, just to make to I got this right. > > # Xmas scan, caught nmap v3.00 > $IPT -t nat -A PREROUTING -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG > --log-prefix "PREROUTING: " --log-tcp-options --log-ip-options > $IPT -t nat -A PREROUTING -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP > > # Generic Xmas scan, haven't checked if nmap triggers this > $IPT -t nat -A PREROUTING -p tcp --tcp-flags ALL ALL -j LOG --log-prefix > "PREROUTING: " --log-tcp-options --log-ip-options > $IPT -t nat -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP As far as I know and can see - no. > # Misc scan - everyone tests for this, but what scan does it match? > $IPT -t nat -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j LOG > --log-prefix "PREROUTING: " --log-tcp-options --log-ip-options > $IPT -t nat -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP > > # FIN scan, nmap v3.0 sends ACK,FIN FIN > # SYN,FIN SYN,FIN does not match nmap > # FIN FIN gets false positives when using SSH TARPIT > $IPT -t nat -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -m state > --state NEW -j LOG --log-prefix "PREROUTING: " --log-tcp-options > --log-ip-options > $IPT -t nat -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -m state > --state NEW -j DROP I think at least the NULL scan (--tcp-flags ALL NONE) is missing and ACK scan (--tcp-flags ACK|ALL ACK -m state --state NEW). But the latter situation may also occur, if your TCP crashes (loosing all connection information) durind data transfer or the like and then comes back (however this may happen). Dropping the packet leaves the sender, who thinks there is a connection, waiting until timeout. So, to see, if this is a scan, it may be more secure to combine it with the recent match (personally I think, that this will happen very seldom on a Linux box, but I may be totally wrong). Have a nice time, Joerg
