PORTSCAN DETECTOR

# Anti nmap :)
iptables -N PORTSCAN
iptables -A INPUT -i all -p tcp --tcp-flags ALL FIN,URG,PSH -m recent --set -j PORTSCAN
iptables -A FORWARD -i all -p tcp --tcp-flags ALL FIN,URG,PSH -m recent --set -j PORTSCAN

# SYN/RST
iptables -A INPUT -i all -p tcp --tcp-flags SYN,RST SYN,RST -m recent --set -j PORTSCAN
iptables -A FORWARD -i all -p tcp --tcp-flags SYN,RST SYN,RST -m recent --set -j PORTSCAN

# SYN/FIN -- Scan(probably)
iptables -A INPUT -i all -p tcp --tcp-flags SYN,FIN SYN,FIN -m recent --set -j PORTSCAN
iptables -A FORWARD -i all -p tcp --tcp-flags SYN,FIN SYN,FIN -m recent --set -j PORTSCAN

# NMAP FIN Stealth
iptables -A INPUT -i all -p tcp --tcp-flags ALL FIN -m recent --set -j PORTSCAN
iptables -A FORWARD -i all -p tcp --tcp-flags ALL FIN -m recent --set -j PORTSCAN

# ALL/ALL Scan
iptables -A INPUT -i all -p tcp --tcp-flags ALL ALL -m recent --set -j PORTSCAN
iptables -A FORWARD -i all -p tcp --tcp-flags ALL ALL -m recent --set -j PORTSCAN

# NMAP Null Scan
iptables -A INPUT -i all -p tcp --tcp-flags ALL NONE -m recent --set -j PORTSCAN
iptables -A FORWARD -i all -p tcp --tcp-flags ALL NONE -m recent --set -j PORTSCAN

#XMAS
iptables -A INPUT -i all -p tcp --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN -m recent --set -j PORTSCAN
iptables -A FORWARD -i all -p tcp --tcp-flags ALL URG,ACK,PSH,RST,SYN,FIN -m recent --set -j PORTSCAN
iptables -A PORTSCAN -m limit --limit 1/second -j LOG --log-level info --log-prefix "PORTSCAN -- SHUN " --log-tcp-sequence --log-tcp-options --log-ip-options

# Drop this packet !!
iptables -A PORTSCAN -j DROP