2

I am using pfsense as a firewall, and I would like to know how I can stop network scans from enumerating open services and ports.

5

Two answers to this question:

  1. You can't
  2. Port Knocking

Services exist to be connected to. If you have a service, then you need to allow clients to connect to it, and once you do that, it is open to be 'enumerated'. You can't block someone from trying a service to see if it responds because you need that ability for clients to connect to you.

... Unless you obfuscate the service port. Port Knocking allows you to open a service port to an client IP only if the client IP performed certain actions (usually pinging certain port numbers in a particular sequence). This is not a 'secure' method, but it does effectively hide a port from unauthorized 'enumeration'. The problem with this scheme is that all clients need to know the secret knock before they are allowed access, which is not good for public services.

But even with Port Knocking, people can still try to enumerate your ports, they just might not get the true ports of the services.

  • While this might be true for pfsense (I'm not sure, never tried it) detecting and blocking a port scan in progress is certainly possible. – DKNUCKLES Jul 7 '14 at 19:34
  • As long as the port scan follows very narrow characteristics. It's a reverse port-knock: if an IP hits certain ports in a certain way, then close all ports to the IP. The problem is that this measure is easily bypassed by slow scans, switching IPs, hitting common ports, etc. – schroeder Jul 7 '14 at 19:38
3

I'm not sure with pfsense, but this is possible with psad:

psad makes use of Netfilter log messages to detect, alert, and (optionally) block port scans and other suspect traffic. For tcp scans psad analyzes tcp flags to determine the scan type (syn, fin, xmas, etc.) and corresponding command line options that could be supplied to nmap to generate such a scan. In addition, psad makes use of many tcp, udp, and icmp signatures contained within the Snort intrusion detection system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.