I am creating a virtual environment where I have created three virtual machines,
- CentOS as an Apache Webserver
- CentOs as an Attacker machine
- FreeBSD with Honeyd to setup Honeypot
I have connected all three virtual machines in a same network, and installed honeyd in Attacker machine.
The IP of attacker is
The IP of machine where honeyd is installed is
The IP of honeypot that is created by
The IP of my Apache Webserver is
Using Attacker machine I perform an
nmap scan using the following command,
honeyd successfully detected the attack.
But I have one problem,
honeyd is installed in separate machine as Apache webserver. How can I block TCP scans from the attacker IP address to my webserver?
I installed a firewall in my Apache webserver virtual machine but how does my Apache machine know which IP are performing attacks so that I can block them?