Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that
iptables logs these activities)?
you can add it like this (when you have
by creating a file in
Or you could use programs like PortSentry to do the blocking/releasing after some timeout, which have some more advanced features. Note however that blocking is not bulletproof -- due to way TCP/IP works (UDP packets, or TCP packets before completed 3way handshake) it is quite possible (as portscanners have options to also send lots of faked source IP packets in order to hide real scanner) that you'll end up blocking lots of innocent users (possibly including your own admin access to the server).