Printable View
Hello everyone,
Is there some way to setup a firewall to stop the box from responding to port scans? Does a port scanner actually initate each TCP connection like it would, say when you're connecting to a regular web page? If it doesn't, then is there some way to recognize that its a port scanner on the other side and stop the response??
If I'm not mistaken pretty much any firewall will do exactly that... speaking of which you should really be running a firewall anyway. Any one is better than none.
I am running a firewall, but I'm talking about services. If I'm running a web server that's availble to the internet, won't a port scanner detect that as well?
From what I have seen most comercial personal firewalls for Windows have rulesets built in to prevent port scanning.
Any good firewall that uses stateful packet filtering should be able to be configured to block port scanning.
Port scanners work in many different ways, Nmap's documentation gives a pretty good description on different portscan methods.
not really, if your running a web server and a scanner sends a request for a tcp connection to port 80, you server is going to respond. theres no way to stop that. thats why you better know how to secure your box if your going to run a server on the internet.
Tedob1 is right. When you think about it, a port scan is no different to a legitimate TCP connection. What is the difference between the following?
- Using a port scanner to scan machine x on port 80.
- Telnetting to machine x on port 80.
- Using a browser to access machine x on port 80.
Thats right, Nothing.
Any firewall configured correctly, wont "prevent" port scanning, but it will certainly drop packets that you havent specifically allowed through. (Thats what firewalls do!!)
Again, I whole heartedly agree with Tedob1, and think that it is crucially important to learn how to configure Firewall rules, harden machines before placing them in ANY public environment.
I agree with Ted and Soggy - good points both of you. Ok, here's the thing, port scanners such as Nmap take advantage of the inherent "weaknesses" in the TCP/IP stack. For example, it is natural for a host's stack to reply to a SYN packet with an ACK, ...and so on and so forth. A scanner will look for the expected response to whatever type of scan it's doing in order to determine if the port in question is indeed open. I highly recommend reading up on Nmap as suggested since it comes with a "small" plethora of scan types to help probe a host. I hope this helps you understand. If you still need help, let us know. That's what AO is here for.
http://www.psionic.com/products/
port sentry
it will detect port scans even stealth scans and do what you want with the ip
really easy to set up and pretty good in my eyes hope it helps
rioter
Have some sort of active IDS which installs realtime rules in the firewall banning IPs?
Maybe but this is not a very good idea because a malicious user who knows about it might IP spoof a genuine user's IP address and have them firewalled out for scanning.
Alternatively, have a firewall with a "fake ack" which responds positively to *any* TCP SYN. That way the scanner cannot tell which ports are open and which merely have a phanton syn ack on them (assuming the initial serial number choosing algorithm it uses is the same as the host's own OS)
That won't stop "full connect" scans, but it will fool syn scans and greatly slow down true connect scans (because the host scanning will wait for the third part of the TCP setup, which will never arrive)
I have no idea what programs / products have these features but I believe a few do.
Oh yes, and if you use a fake ack make sure the scan packets never reach the host OS or its RSTs will give the game away
There are a couple of things I would recommend, one has already been mentioned:
psionic portsentry. Set it up to return tons of bogus information, it will not only detect the port scans, but you can set it up to then automatically block that IP (be careful, or you might block yourself). If it returns too much bogus information, the scan is useless.
Another thing you can do is have a proxying firewall that answers for every port, every IP on your network. AT a minimum it will slow every scan to a crawl and on the up side, it will return every IP is up and every IP has every port open...completely useless to the scanner :) Of course it is a royal pain in the rear to do that and get it working right, but much more of a pain to the person scanning you (and you might want to just do it for well known ports and deny rest)
Either way, tons of garbage information will taint the results, possibly so bad that they move on...
/nebulus
I personally use BlackICEDefender from NetworkICE that stops many, if not all port scans. In ffact even now it has just warned me and bloked a SOCKS port scan.
You can get it from http://www.networkice.com i think. well worth it.
[pong]Frolic As The Llama Would[/pong]
Er..... Actually ports that answer usually speed up a scan, it's the ports that don't answer and therefore require retries after the preset reply timeout that really slow down scans hence any good scanner allows you to set the number of retries and the timeout between retries so you can make the scan more efficient or effective depending on other factors.Quote:
Originally posted here by nebulus200
Another thing you can do is have a proxying firewall that answers for every port, every IP on your network. AT a minimum it will slow every scan to a crawl and on the up side, it will return every IP is up and every IP has every port open...completely useless to the scanner :)
/nebulus
Hallo,
a firewall can reject or deny Ports which shall be denied.
REJECT - reject forwarding of IP packet
DENY - simply ignore IP packet
If you want to stop the box from responding port scans you have to choose the deny method.
Then the connection to the ports will timeout. But you can not stop the portscan self because the portscanner can send thousand request simoustanly during waiting for response.
But whit Deny you stop the requests of legitimacy servers, for example the ident request of port 113. Therefore you will help spamer and scriptkiddies by choosing the deny method.
Reject will reject the request activly, and is as secure as deny.
Sorry for my bad english.
One thing to bear in mind regarding IDS is that a good 'port scanner' (as in whoever is doing the scan) will try to defeat the IDS so that it doesn`t raise an alert, the most common way being to run the port scan exceptionally slowly (i.e. paranoid mode on nmap). Most script kiddies won`t do this however as it can make the port scan take days, so you`ll catch most of them with an IDS and by checking your firewall logs.
As some of the other postings have said, whatever services you allow through the firewall (i.e. http on port 80) a port scan will detect these, as you cannot block Port 80 or you would not get any traffic on your web server, and the same applies to any other services you want to allow through.
You could set your applications (wherever possible) to use non standard ports, at least that way an attacker won`t instantly know what services you are running, although that isn`t practical for anything you want the public to access.
I think as long as you have decent security measures in place a port scan shouldn`t be something you worry too much about.
One thing to bear in mind regarding IDS is that a good 'port scanner' (as in whoever is doing the scan) will try to defeat the IDS so that it doesn`t raise an alert, the most common way being to run the port scan exceptionally slowly (i.e. paranoid mode on nmap). Most script kiddies won`t do this however as it can make the port scan take days, so you`ll catch most of them with an IDS and by checking your firewall logs.
As some of the other postings have said, whatever services you allow through the firewall (i.e. http on port 80) a port scan will detect these, as you cannot block Port 80 or you would not get any traffic on your web server, and the same applies to any other services you want to allow through.
You could set your applications (wherever possible) to use non standard ports, at least that way an attacker won`t instantly know what services you are running, although that isn`t practical for anything you want the public to access.
I think as long as you have decent security measures in place a port scan shouldn`t be something you worry too much about.