I am hosting a web server, both standard and SSL. Both work fine currently.
In my logs, I've noticed what seems like a distributed port-scan: 10-15 port queries from random hosts occuring within seconds of eachother every few hours.
I have fail2ban up and running, but since the source IPs are always different, it doesn't catch this kind of attack. The destination port is always different, but the source port is always 443.
Is an effective way to block this attack to block packets with source port 443, or is that going to interfere with my https server?
iptableshas lost track of; it therefore no longer regards these packets as part of
RELATEDconnections and drops them.