Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that iptables logs these activities)?

share|improve this question
    
This may help: communaute.digicube.fr/forum/viewtopic.php?id=28 but you'll need to Google Translate it from French. –  ionFish Jun 11 '12 at 15:18
    
It wont really work. What worked for us was blocking countries that we do not have business in. We use Iptables / GeoIP to block countries like Ukraine / Pakistan / France and others that we have no business in. Iptables is probably your best line of defense. If yours is a web app, and you need to have some ports open (80 443) consider using a reverse proxy. A reverse proxy like Squid, Pound or NginX can handle filtering of traffic for you. If you only have port 80 open, a port scanner will not help a hacker. Next cover your ass for SQL injection and XSS attacks. –  Frank Nov 13 '12 at 9:33
add comment

1 Answer 1

you can add it like this (when you have iptables ... -j LOG to mark scans you want) by adding additional fail2ban filter like this

 # Option: failregex  
 # Notes: Looks for attempts on ports not open in your firewall. Expects the  
 # iptables logging utility to be used. Add the following to your iptables  
 # config, as the last item before you DROP or REJECT:  
 # -A <chain_name> -j LOG --log-prefix "PORT DENIED: " --log-level 5 --log-ip-options --log-tcp-options --log-tcp-sequence  
 # This will place a notice in /var/log/messages about any attempt on a port that isn't open.  
 failregex = PORT DENIED: .* SRC=<HOST>  

by creating a file in /etc/fail2ban/filters.d directory. more information

Or you could use programs like PortSentry to do the blocking/releasing after some timeout, which have some more advanced features. Note however that blocking is not bulletproof -- due to way TCP/IP works (UDP packets, or TCP packets before completed 3way handshake) it is quite possible (as portscanners have options to also send lots of faked source IP packets in order to hide real scanner) that you'll end up blocking lots of innocent users (possibly including your own admin access to the server).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.