fduran/scanblocker repository overview

⁠Scanblocker

Listens to a Linux interface via pcap and prints out connection attempts. It will block via iptables source IP addresses outside the host that try to connect too quickly to different host ports.

To run: sudo docker run --rm --net=host --name scanblocker scanblocker .

Notes:

• Default iface to listen to is eth0, to change to for example to ens4, pass it as the environment variable SB_DEVICE: sudo docker run --rm --env SB_DEVICE=ens4 --net=host --name scanblocker scanblocker
• The --net=host option is needed since we are listening on the host's device.
• Tested on Ubuntu and Debian (Debian from version 10 uses nftables so to use iptables: sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
• The iptables command is an "append" one: /usr/sbin/iptables -A INPUT -s $srcip -j DROP. To list do sudo iptables -L INPUT and to delete (flush) do sudo iptables -F INPUT
• There is no iptable rules management, as in they are not saved for example upon reboot (unless there's an external mechanism for that).