Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 1 down vote favorite

Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that iptables logs these activities)?

share|improve this question
This may help: communaute.digicube.fr/forum/viewtopic.php?id=28 but you'll need to Google Translate it from French. – ionFish Jun 11 '12 at 15:18
It wont really work. What worked for us was blocking countries that we do not have business in. We use Iptables / GeoIP to block countries like Ukraine / Pakistan / France and others that we have no business in. Iptables is probably your best line of defense. If yours is a web app, and you need to have some ports open (80 443) consider using a reverse proxy. A reverse proxy like Squid, Pound or NginX can handle filtering of traffic for you. If you only have port 80 open, a port scanner will not help a hacker. Next cover your ass for SQL injection and XSS attacks. – Frank Nov 13 '12 at 9:33

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.