This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Irritating portscanner...

Hi all,
For the last 3 weeks, I have a very irritating person who's scanning my ports 4 times a day!
I know ASG will drop the packets but I want to block his IP permantly!
In iptables there's an option to drop his connection. Is it possible to disable his IP to access the firewall? If so, how do I do this?

in the meanwhile: Everyone: HAPPY NEW YEAR !!!

This thread was automatically locked due to age.

Parents

0 BAlfson over 15 years ago

Fobe, as both Barry and Bruce told you above, the 'Traffic destination' in the traffic selector portion of the DNAT must be "External (Address)" instead of "Any." For the reason for that and a discussion of the INPUT and FORWARD chains, see: https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/p/39358/134494#134494

Cheers - Bob
PS If you log the packet filter rule above, I think you'll find that you have the same experience I did.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 15 years ago

Fobe, as both Barry and Bruce told you above, the 'Traffic destination' in the traffic selector portion of the DNAT must be "External (Address)" instead of "Any." For the reason for that and a discussion of the INPUT and FORWARD chains, see: https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/p/39358/134494#134494

Cheers - Bob
PS If you log the packet filter rule above, I think you'll find that you have the same experience I did.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 PabloDiablo over 15 years ago in reply to BAlfson

I took your advice. Unfortunately it doesn't work. I still get portscan detections from that dude from China!
I have 2 WAN-connections I made DNAT-settings for both WAN-interfaces and 1 PF-rule. What I'm doing wrong?
It is now set as follows:

PF Rule:
Source : IP(s) to be dropped
Service : ANY
Destination: ANY
Action : DROP

1st DNAT Rule:

Traffic Source : IP(s) to be dropped
Traffic Service : ANY
Traffic Destination: WAN-1
NAT Mode : DNAT
Destionation : IP of a not existing host on LAN

2nd DNAT Rule:

Traffic Source : IP(s) to be dropped
Traffic Service : ANY
Traffic Destination: WAN-2
NAT Mode : DNAT
Destionation : IP of a not existing host on LAN
Cancel
Vote Up 0 Vote Down

Cancel