0

I want to block nmap's ack ping probes and in order to do that, I fist need to block all incoming ack packets coming on port 80. I used this command but it didnt work:

iptables -A INPUT -p tcp --dport 80 --tcp-falgs ALL ACK -j DROP

The thing is it works with any port other than 80 and 443 and they happen to be the ports for http/https protocols. Is there any way to make this work and block those unexpected ACK packets on those ports?

Here is all of my rules that from input chain:

iptables -P INPUT DROP

iptables -A INPUT -p tcp --dport 80 --tcp-flags ALL ACK -j LOG --log-prefix "PSAD: ACK PING "
iptables -A INPUT -p tcp --dport 80 --tcp-flags ALL ACK -j DROP

iptables -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID " --log-ip-options --log-tcp-options
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT

Thank you in advance...

xparks37
  • 1
  • 1
  • 2
    What is the actual state of your firewall? e.g. `iptables -nvL` – Michael Hampton Sep 07 '20 at 02:28
  • Here is the screenshot of firewall state after I launched an ACK scan against port 22 and 80. ACK packet destined for port 22 is caught but as for port 80 there's nothing going on. https://ibb.co/hdLWBm7 – xparks37 Sep 07 '20 at 12:58
  • 1
    Please update your question to include that image instead of linking to it in the comments. – Tommiie Sep 08 '20 at 10:37

1 Answers1

0

I apologize to everyone for taking your time. I just noticed that I had a nat rule that forwards all packets coming to port 80 to another ip address where no host is running. And since PREROUTING comes before INPUT chain it gets forwarded directly to another host that doesnt exist. That's why rules I applied didnt take any effect

xparks37
  • 1
  • 1
  • Can you please mark this as the correct answer to your question? Or remove your question alltogether. – Tommiie Sep 08 '20 at 10:37