5

Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that iptables logs these activities)?

2
  • This may help: communaute.digicube.fr/forum/viewtopic.php?id=28 but you'll need to Google Translate it from French.
    – ionFish
    Jun 11 '12 at 15:18
  • It wont really work. What worked for us was blocking countries that we do not have business in. We use Iptables / GeoIP to block countries like Ukraine / Pakistan / France and others that we have no business in. Iptables is probably your best line of defense. If yours is a web app, and you need to have some ports open (80 443) consider using a reverse proxy. A reverse proxy like Squid, Pound or NginX can handle filtering of traffic for you. If you only have port 80 open, a port scanner will not help a hacker. Next cover your ass for SQL injection and XSS attacks.
    – Frank
    Nov 13 '12 at 9:33
4

you can add it like this (when you have iptables ... -j LOG to mark scans you want) by adding additional fail2ban filter like this

 # Option: failregex  
 # Notes: Looks for attempts on ports not open in your firewall. Expects the  
 # iptables logging utility to be used. Add the following to your iptables  
 # config, as the last item before you DROP or REJECT:  
 # -A <chain_name> -j LOG --log-prefix "PORT DENIED: " --log-level 5 --log-ip-options --log-tcp-options --log-tcp-sequence  
 # This will place a notice in /var/log/messages about any attempt on a port that isn't open.  
 failregex = PORT DENIED: .* SRC=<HOST>  

by creating a file in /etc/fail2ban/filter.d (not /etc/fail2ban/filters.d) directory. more information

Or you could use programs like PortSentry to do the blocking/releasing after some timeout, which have some more advanced features. Note however that blocking is not bulletproof -- due to way TCP/IP works (UDP packets, or TCP packets before completed 3way handshake) it is quite possible (as portscanners have options to also send lots of faked source IP packets in order to hide real scanner) that you'll end up blocking lots of innocent users (possibly including your own admin access to the server).

2
  • So in order for this to work i must block all ports except selected it can not work like that it would record timeouts instead of DROP/DENY? my default iptables-save is -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT So if i block all, and whitelist SSH + a few other ( ecosia.org/search?q=iptables+block+all+except+SSH ), i have to add mentioned blocking rule before the last "BLOCK ALL" kind of line?
    – 16851556
    Mar 13 at 18:58
  • @16851556 yes, you must allow all traffic you want first. Note that policy blocking (-P INPUT etc.) isn't enough, for fail2ban to work you need that -j LOG target as the last rule before so it will get logged (fail2ban will simply check the logs and block access for all IP addresses mentioned in the log that match that regular expression). Mar 14 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.