Blackhole route for IP, still having portscan alerts

additionally add the badguys group to IPS exeptions for portscans.

I prefer a blackhole DNAT because a blackhole route does not catch access to local services

Isn't routing the 1st process ?

I also tried the DNAT solution, natting destination to 240.0.0.0, but still had portscan events.

Hi Geert,

Alerts are generated because of the configured portscan settings in UTM:  Network Security -> Intrusion Protection -> Anti-Portscan Detection.

Limit Logging - Enable this option to limit logging. A portscan detection can generate many logs while a portscan is being carried out. Selecting this option will restrict logging to five lines per second. 6. Click Apply to save the settings.

A portscan detection can generate many logs while a portscan is being carried out. Selecting this option will restrict logging to five lines per second.

Thanks

Hi,

i understand where the e-mail alerts come from and i have activated the log restriction.

Anyhow, sometimes we get massive port scanning from 1 IP during a very long period of time.

What i would like is to maintain a blacklist of IP's of which traffic is immediately dropped (no processing) as such generating no alerts / events.

I hope this clarifies my question.

Hi Greet,

Priority of Intrusion Prevention module comes before DNAT i.e., pre-routing IP table. Hence, the packet arriving on the UTM interface will be checked via Intrusion Prevention and alert will be generated before the traffic is mapped towards the blackhole. That is because of the architectural behavior. Here we are not actually dropping(blackhole) the traffic instead, we are mapping the traffic towards a non-existing IP address. 

Hope that helps.