3 ms·

Perhaps this could be useful if you ran it on a vast number of ports. Just running it on the one doesn't seem to make an attacker's life much more difficult.

penagwin 8y ago
Running it on just 22 should be pretty effective on it's own. Large scale port scanning is semi-difficult, as you'll get banned really fast, even if you're just scanning an uncommon port. To pull it off, you'll either need your host to be okay with the abuse complaints (that are usually automated) or have a botnet/proxy list. However even then there's 65535 different ports (not to mention almost 4.3 billion ipv4 addresses), and you'll likely can firewalled off pretty fast. So instead of scanning 65535 ports, scanning just 22 usually works anyway, as few people change their ssh ports (and those that do are more likely to have other security measures in place)
LinuxBender 8y ago
That would be easy to do with an iptables DNAT rule. You can take a large set of ports and forward them to this daemon. iptables -t nat -I PREROUTING -m tcp -p tcp --dport 1:79 -j DNAT --to-destination x.x.x.x:2222 iptables -t nat -I PREROUTING -m tcp -p tcp --dport 81:442 -j DNAT --to-destination x.x.x.x:2222 ...etc Just remember to open those same ports in the INPUT rules. If you get DDoS, then also create NOTRACK target rules in the raw table to avoid hitting the conntrack table.
- fxfan 8y ago
  You truly sound like a bender. Is there a quick start to iptables somewhere? Is iptables the defacto network tool? And can one prevent ddos using iptables?
  - 0db532a0 8y ago
    iptables is a firewall/NAT interface. nftables is newer and easier to learn, at least to me. You might want to get into that instead of iptables.
  - LinuxBender 8y ago
    > And can one prevent ddos using iptables? No, but you can minimize the impact or effectiveness of the attack. This is a long topic however. Probably better suited to a blog post or a youtube video.

penagwin 8y ago

Running it on just 22 should be pretty effective on it's own. Large scale port scanning is semi-difficult, as you'll get banned really fast, even if you're just scanning an uncommon port. To pull it off, you'll either need your host to be okay with the abuse complaints (that are usually automated) or have a botnet/proxy list. However even then there's 65535 different ports (not to mention almost 4.3 billion ipv4 addresses), and you'll likely can firewalled off pretty fast. So instead of scanning 65535 ports, scanning just 22 usually works anyway, as few people change their ssh ports (and those that do are more likely to have other security measures in place)

LinuxBender 8y ago

That would be easy to do with an iptables DNAT rule. You can take a large set of ports and forward them to this daemon. iptables -t nat -I PREROUTING -m tcp -p tcp --dport 1:79 -j DNAT --to-destination x.x.x.x:2222 iptables -t nat -I PREROUTING -m tcp -p tcp --dport 81:442 -j DNAT --to-destination x.x.x.x:2222 ...etc Just remember to open those same ports in the INPUT rules. If you get DDoS, then also create NOTRACK target rules in the raw table to avoid hitting the conntrack table.

fxfan 8y ago
You truly sound like a bender. Is there a quick start to iptables somewhere? Is iptables the defacto network tool? And can one prevent ddos using iptables?
- 0db532a0 8y ago
  iptables is a firewall/NAT interface. nftables is newer and easier to learn, at least to me. You might want to get into that instead of iptables.
- LinuxBender 8y ago
  > And can one prevent ddos using iptables? No, but you can minimize the impact or effectiveness of the attack. This is a long topic however. Probably better suited to a blog post or a youtube video.