I am using pfsense as a firewall, and I would like to know how I can stop network scans from enumerating open services and ports.
Two answers to this question:
- You can't
- Port Knocking
Services exist to be connected to. If you have a service, then you need to allow clients to connect to it, and once you do that, it is open to be 'enumerated'. You can't block someone from trying a service to see if it responds because you need that ability for clients to connect to you.
... Unless you obfuscate the service port. Port Knocking allows you to open a service port to an client IP only if the client IP performed certain actions (usually pinging certain port numbers in a particular sequence). This is not a 'secure' method, but it does effectively hide a port from unauthorized 'enumeration'. The problem with this scheme is that all clients need to know the secret knock before they are allowed access, which is not good for public services.
But even with Port Knocking, people can still try to enumerate your ports, they just might not get the true ports of the services.
I'm not sure with pfsense, but this is possible with psad:
psad makes use of Netfilter log messages to detect, alert, and (optionally) block port scans and other suspect traffic. For tcp scans psad analyzes tcp flags to determine the scan type (syn, fin, xmas, etc.) and corresponding command line options that could be supplied to nmap to generate such a scan. In addition, psad makes use of many tcp, udp, and icmp signatures contained within the Snort intrusion detection system.