I am using pfsense as a firewall, and I would like to know how I can stop network scans from enumerating open services and ports.
-
I use portsentry. If the attacker reaches 5 closed ports, he gets banned on the firewall.– ThoriumBRCommented Sep 4 at 21:00
Add a comment
|
3 Answers
Two answers to this question:
- You can't
- Port Knocking
Services exist to be connected to. If you have a service, then you need to allow clients to connect to it, and once you do that, it is open to be 'enumerated'. You can't block someone from trying a service to see if it responds because you need that ability for clients to connect to you.
... Unless you obfuscate the service port. Port Knocking allows you to open a service port to an client IP only if the client IP performed certain actions (usually pinging certain port numbers in a particular sequence). This is not a 'secure' method, but it does effectively hide a port from unauthorized 'enumeration'. The problem with this scheme is that all clients need to know the secret knock before they are allowed access, which is not good for public services.
But even with Port Knocking, people can still try to enumerate your ports, they just might not get the true ports of the services.
answered Jul 7, 2014 at 14:49
-
While this might be true for pfsense (I'm not sure, never tried it) detecting and blocking a port scan in progress is certainly possible. Commented Jul 7, 2014 at 19:34
-
As long as the port scan follows very narrow characteristics. It's a reverse port-knock: if an IP hits certain ports in a certain way, then close all ports to the IP. The problem is that this measure is easily bypassed by slow scans, switching IPs, hitting common ports, etc.– schroeder ♦Commented Jul 7, 2014 at 19:38
I'm not sure with pfsense, but this is possible with psad:
psad makes use of Netfilter log messages to detect, alert, and (optionally) block port scans and other suspect traffic. For tcp scans psad analyzes tcp flags to determine the scan type (syn, fin, xmas, etc.) and corresponding command line options that could be supplied to nmap to generate such a scan. In addition, psad makes use of many tcp, udp, and icmp signatures contained within the Snort intrusion detection system.
answered Jul 8, 2014 at 14:08
Well, PFsense itself is just a firewall, you can add more capabilities to it through the ports / package system though. And this enables us to add something like snort, which can be setup to do Intrusion Detection System (IDS).
This article from 2019 explains how you can do this.
And once you have snort on your firewall, it’s just a matter of configuring it to detect the port scan and implement a block.
