<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hello Noel,<div><br></div><div>I just tried the suggested solution below and sadly it blocks the entire VPN.</div><div><br></div><div><div><font face="monospace">iptables -I FORWARD 2 -d <a href="http://192.168.0.0/16">192.168.0.0/16</a> -j REJECT</font></div><div><font face="monospace">iptables -I FORWARD 2 -d <a href="http://172.16.0.0/12">172.16.0.0/12</a> -j REJECT</font></div><div><font face="monospace">iptables -I FORWARD 2 -d <a href="http://10.0.0.0/8">10.0.0.0/8</a> -j REJECT</font></div></div><div><br></div><div>Unless I have inserted the rules at the wrong spot, it doesn't look good. See below, please:</div><div><br></div><div><div><font face="monospace"># Generated by iptables-save v1.6.1 on Mon Oct 14 18:33:31 2019</font></div><div><font face="monospace">*mangle</font></div><div><font face="monospace">:PREROUTING ACCEPT [54716:20906174]</font></div><div><font face="monospace">:INPUT ACCEPT [26852:4628015]</font></div><div><font face="monospace">:FORWARD ACCEPT [27829:16271441]</font></div><div><font face="monospace">:OUTPUT ACCEPT [25477:18649644]</font></div><div><font face="monospace">:POSTROUTING ACCEPT [52098:34734180]</font></div><div><font face="monospace">-A FORWARD -s <a href="http://10.10.10.0/24">10.10.10.0/24</a> -o eth0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360</font></div><div><font face="monospace">COMMIT</font></div><div><font face="monospace"># Completed on Mon Oct 14 18:33:31 2019</font></div><div><font face="monospace"># Generated by iptables-save v1.6.1 on Mon Oct 14 18:33:31 2019</font></div><div><font face="monospace">*nat</font></div><div><font face="monospace">:PREROUTING ACCEPT [1575:110530]</font></div><div><font face="monospace">:INPUT ACCEPT [28:8296]</font></div><div><font face="monospace">:OUTPUT ACCEPT [429:29655]</font></div><div><font face="monospace">:POSTROUTING ACCEPT [429:29655]</font></div><div><font face="monospace">-A POSTROUTING -s <a href="http://10.10.10.0/24">10.10.10.0/24</a> -o eth0 -m policy --dir out --pol ipsec -j ACCEPT</font></div><div><font face="monospace">-A POSTROUTING -s <a href="http://10.10.10.0/24">10.10.10.0/24</a> -o eth0 -j MASQUERADE</font></div><div><font face="monospace">COMMIT</font></div><div><font face="monospace"># Completed on Mon Oct 14 18:33:31 2019</font></div><div><font face="monospace"># Generated by iptables-save v1.6.1 on Mon Oct 14 18:33:31 2019</font></div><div><font face="monospace">*filter</font></div><div><font face="monospace">:INPUT DROP [1:40]</font></div><div><font face="monospace">:FORWARD DROP [0:0]</font></div><div><font face="monospace">:OUTPUT ACCEPT [102:15526]</font></div><div><font face="monospace">-A INPUT -i lo -j ACCEPT</font></div><div><font face="monospace">-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p tcp -m tcp --dport 2022 -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p udp -m udp --dport 500 -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p udp -m udp --dport 4500 -j ACCEPT</font></div><div><font face="monospace">-A FORWARD -s <a href="http://10.10.10.0/24">10.10.10.0/24</a> -d <a href="http://10.10.10.0/24">10.10.10.0/24</a> -j DROP</font></div><div><font face="monospace">-A FORWARD -d <a href="http://10.0.0.0/8">10.0.0.0/8</a> -j REJECT --reject-with icmp-port-unreachable</font></div><div><font face="monospace">-A FORWARD -d <a href="http://172.16.0.0/12">172.16.0.0/12</a> -j REJECT --reject-with icmp-port-unreachable</font></div><div><font face="monospace">-A FORWARD -d <a href="http://192.168.0.0/16">192.168.0.0/16</a> -j REJECT --reject-with icmp-port-unreachable</font></div><div><font face="monospace">-A FORWARD -m policy --dir in --pol ipsec -j ACCEPT</font></div><div><font face="monospace">-A FORWARD -m policy --dir out --pol ipsec -j ACCEPT</font></div><div><font face="monospace">COMMIT</font></div></div><div><br></div><div>If this doesn't work I have to fallback to your initial solution:</div><div><br></div><font face="monospace">iptables -I FORWARD 2 -m conntrack --ctstate NEW -m hashlimit --hashlimit-name NETSCAN --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-upto 5/s -j ACCEPT</font><div><font face="monospace"><br></font></div>With the following outcome:<div><font face="monospace"><br></font></div><div><div><font face="monospace"># Generated by iptables-save v1.6.1 on Mon Oct 14 18:40:26 2019</font></div><div><font face="monospace">*filter</font></div><div><font face="monospace">:INPUT DROP [192413:18329342]</font></div><div><font face="monospace">:FORWARD DROP [340475:90672719]</font></div><div><font face="monospace">:OUTPUT ACCEPT [425183776:485173348374]</font></div><div><font face="monospace">-A INPUT -i lo -j ACCEPT</font></div><div><font face="monospace">-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p tcp -m tcp --dport 2022 -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p udp -m udp --dport 500 -j ACCEPT</font></div><div><font face="monospace">-A INPUT -p udp -m udp --dport 4500 -j ACCEPT</font></div><div><font face="monospace">-A FORWARD -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -d <a href="http://10.10.0.0/17">10.10.0.0/17</a> -j DROP</font></div><div><font face="monospace">-A FORWARD -m conntrack --ctstate NEW -m hashlimit --hashlimit-upto 5/sec --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name NETSCAN -j ACCEPT</font></div><div><font face="monospace">-A FORWARD -m policy --dir in --pol ipsec -j ACCEPT</font></div><div><font face="monospace">-A FORWARD -m policy --dir out --pol ipsec -j ACCEPT</font></div><div><font face="monospace">COMMIT</font></div><div><font face="monospace"># Completed on Mon Oct 14 18:40:26 2019</font></div><div><font face="monospace"># Generated by iptables-save v1.6.1 on Mon Oct 14 18:40:26 2019</font></div><div><font face="monospace">*nat</font></div><div><font face="monospace">:PREROUTING ACCEPT [133256521:12349660945]</font></div><div><font face="monospace">:INPUT ACCEPT [805996:248685578]</font></div><div><font face="monospace">:OUTPUT ACCEPT [151185:15397949]</font></div><div><font face="monospace">:POSTROUTING ACCEPT [151185:15397949]</font></div><div><font face="monospace">-A POSTROUTING -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -o enp2s0 -m policy --dir out --pol ipsec -j ACCEPT</font></div><div><font face="monospace">-A POSTROUTING -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -o enp2s0 -j MASQUERADE</font></div><div><font face="monospace">COMMIT</font></div><div><font face="monospace"># Completed on Mon Oct 14 18:40:26 2019</font></div><div><font face="monospace"># Generated by iptables-save v1.6.1 on Mon Oct 14 18:40:26 2019</font></div><div><font face="monospace">*mangle</font></div><div><font face="monospace">:PREROUTING ACCEPT [47285409804:29854894928171]</font></div><div><font face="monospace">:INPUT ACCEPT [16114043471:4661974048771]</font></div><div><font face="monospace">:FORWARD ACCEPT [31166444886:25192112917092]</font></div><div><font face="monospace">:OUTPUT ACCEPT [20092152323:23622919704514]</font></div><div><font face="monospace">:POSTROUTING ACCEPT [51247881050:48812187889401]</font></div><div><font face="monospace">-A FORWARD -s <a href="http://10.10.0.0/17">10.10.0.0/17</a> -o enp2s0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360</font></div><div><font face="monospace">COMMIT</font></div><div><font face="monospace"># Completed on Mon Oct 14 18:40:26 2019</font></div></div><div><br></div><div>The latter doesn't stop the VPN, but I won't know it really prevents someone from running netscan until someone tries a new attempt again. :)</div><div><br></div><div>What do you think?</div><div><br></div><div>Many Thanks,</div><div>Houman</div><div><br></div></div></div></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 14 Oct 2019 at 17:05, Noel Kuntze <noel.kuntze@thermi.consulting> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Hello Houman,<br>
<br>
Depends on what exactly you're doing on your server. It's not possible to give you a generalized answer.<br>
You shouldn't script with iptables though. Use iptables-save and -restore (save prints out a serialised form of your loaded iptables rules, restore loads data in said form).<br>
<br>
Kind regards<br>
<br>
Noel<br>
<br>
Am 14.10.19 um 14:30 schrieb Houman:<br>
> Hello Noel,<br>
><br>
> It's a bare-metal server that I'm renting (it's not a virtual server) so I assume that it should be in its own private subnet. I have tried to follow up with them, but their support doesn't communicate very well in English. All I could gather is the following:<br>
><br>
> 1) Based on the ROOT SERVER SERVICE AGREEMENT, the scanning of foreign networks or foreign IP addresses is not permitted.<br>
> 2) These RFC1918 networks are not reachable via my external interface (Then why is it a problem? I don't understand them)<br>
><br>
> I did some further research. It seems it is better to do the REJECT rule only on the interface that is connected to the Internet. Otherwise, I could be blocking LAN or vpn peer-to-peer communications. <br>
><br>
> |export INET_IFACE=$(ip route get 8.8.8.8 | awk -- '{printf $5}')|<br>
> |iptables -A FORWARD -o $INET_IFACE -d <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a> <<a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">http://10.0.0.0/8</a>> -j REJECT iptables -A FORWARD -o $INET_IFACE -d <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">172.16.0.0/12</a> <<a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">http://172.16.0.0/12</a>> -j REJECT iptables -A FORWARD -o $INET_IFACE -d <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a> <<a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">http://192.168.0.0/16</a>> -j REJECT|<br>
> Do you agree with this? Or is it rather unnecessary for a StrongSwan server?<br>
><br>
> Thanks,<br>
> Houman<br>
><br>
><br>
><br>
><br>
> On Mon, 14 Oct 2019 at 14:00, Noel Kuntze <noel.kuntze@thermi.consulting> wrote:<br>
><br>
> Hello Houman,<br>
><br>
> You can do that. I wonder though why that is a problem. Are they providing a private subnet on the link of your server?<br>
><br>
> Kind regards<br>
><br>
> Noel<br>
><br>
> Am 14.10.19 um 12:03 schrieb Houman:<br>
> > Hi Noel,<br>
> ><br>
> > That makes sense, thank you.<br>
> ><br>
> > I received a followup email from our server provider (about a new netscan attempt from one of our users today).<br>
> ><br>
> > """<br>
> > We would recommend that you set up a local firewall and block outgoing traffic to the following prefixes<br>
> > <a href="https://tools.ietf.org/html/rfc1918" rel="noreferrer" target="_blank">https://tools.ietf.org/html/rfc1918</a><br>
> > > <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a> <<a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">http://10.0.0.0/8</a>> <<a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">http://10.0.0.0/8</a>><br>
> > > <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">172.16.0.0/12</a> <<a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">http://172.16.0.0/12</a>> <<a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">http://172.16.0.0/12</a>><br>
> > > <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a> <<a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">http://192.168.0.0/16</a>> <<a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">http://192.168.0.0/16</a>><br>
> > Please block this range of RFC1918 on your server. <br>
> > We would like to avoid further network abuse from your end.<br>
> > """<br>
> ><br>
> > Is this as simple as<br>
> ><br>
> > iptables -A FORWARD -d <a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">10.0.0.0/8</a> <<a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">http://10.0.0.0/8</a>> <<a href="http://10.0.0.0/8" rel="noreferrer" target="_blank">http://10.0.0.0/8</a>> -j REJECT<br>
> > iptables -A FORWARD -d <a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">172.16.0.0/12</a> <<a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">http://172.16.0.0/12</a>> <<a href="http://172.16.0.0/12" rel="noreferrer" target="_blank">http://172.16.0.0/12</a>> -j REJECT<br>
> > iptables -A FORWARD -d <a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">192.168.0.0/16</a> <<a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">http://192.168.0.0/16</a>> <<a href="http://192.168.0.0/16" rel="noreferrer" target="_blank">http://192.168.0.0/16</a>> -j REJECT<br>
> ><br>
> > Or am I oversimplifying this?<br>
> ><br>
> > Many Thanks,<br>
> > Houman<br>
> ><br>
> ><br>
> > On Mon, 14 Oct 2019 at 13:02, Noel Kuntze <noel.kuntze@thermi.consulting> wrote:<br>
> ><br>
> > Hello Houman,<br>
> ><br>
> > Depends on if you have a whitelist or blacklist rule set.<br>
> ><br>
> > With the ruleset you have provided in this email, you need to accept the stuff you want. So up to 5 new connections per second.<br>
> ><br>
> > Kind regards<br>
> ><br>
> > Noel<br>
> ><br>
> > Am 14.10.19 um 10:40 schrieb Houman:<br>
> > > Hi Noel,<br>
> > ><br>
> > > Actually based on my firewall config, I think I have to DROP it instead of ACCEPT if it's over the 5/sec limit? Don't you agree?<br>
> > ><br>
> > > iptables -I FORWARD 2 -m conntrack --ctstate NEW -m hashlimit --hashlimit-name NETSCAN --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-above 5/s -j DROP<br>
> > ><br>
> > > So I replace *hashlimit-upto* with *hashlimit-above* following with a DROP.<br>
> > ><br>
> > > This is my current firewall settings based on your previous suggestion. If Iptables is clever enough to DROP the connection if hashlimit-upto is exceeded, it should work as well.<br>
> > ><br>
> > > # iptables-save<br>
> > > *filter<br>
> > > :INPUT DROP [6374:460035]<br>
> > > :FORWARD DROP [7119:2071794]<br>
> > > :OUTPUT ACCEPT [19665335:23255290771]<br>
> > > -A INPUT -i lo -j ACCEPT<br>
> > > -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT<br>
> > > -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT<br>
> > > -A INPUT -p tcp -m tcp --dport 2022 -j ACCEPT<br>
> > > -A INPUT -p udp -m udp --dport 500 -j ACCEPT<br>
> > > -A INPUT -p udp -m udp --dport 4500 -j ACCEPT<br>
> > > -A FORWARD -s <a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">10.10.0.0/17</a> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> -d <a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">10.10.0.0/17</a> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> -j DROP<br>
> > > -A FORWARD -m conntrack --ctstate NEW -m hashlimit --hashlimit-upto 5/sec --hashlimit-burst 5 --hashlimit-mode srcip --hashlimit-name NETSCAN -j ACCEPT<br>
> > > -A FORWARD -m policy --dir in --pol ipsec -j ACCEPT<br>
> > > -A FORWARD -m policy --dir out --pol ipsec -j ACCEPT<br>
> > > COMMIT<br>
> > > # Completed on Mon Oct 14 08:30:14 2019<br>
> > > # Generated by iptables-save v1.6.1 on Mon Oct 14 08:30:14 2019<br>
> > > *nat<br>
> > > :PREROUTING ACCEPT [222978690:20761159044]<br>
> > > :INPUT ACCEPT [1143238:398065963]<br>
> > > :OUTPUT ACCEPT [245876:24207759]<br>
> > > :POSTROUTING ACCEPT [245876:24207759]<br>
> > > -A POSTROUTING -s <a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">10.10.0.0/17</a> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> -o enp2s0 -m policy --dir out --pol ipsec -j ACCEPT<br>
> > > -A POSTROUTING -s <a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">10.10.0.0/17</a> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> -o enp2s0 -j MASQUERADE<br>
> > > COMMIT<br>
> > > # Completed on Mon Oct 14 08:30:14 2019<br>
> > > # Generated by iptables-save v1.6.1 on Mon Oct 14 08:30:14 2019<br>
> > > *mangle<br>
> > > :PREROUTING ACCEPT [76920955633:50815277695359]<br>
> > > :INPUT ACCEPT [27612054762:8305407205459]<br>
> > > :FORWARD ACCEPT [49298861266:42508240159831]<br>
> > > :OUTPUT ACCEPT [34323442858:39692165780388]<br>
> > > :POSTROUTING ACCEPT [83603096494:82195502934979]<br>
> > > -A FORWARD -s <a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">10.10.0.0/17</a> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> <<a href="http://10.10.0.0/17" rel="noreferrer" target="_blank">http://10.10.0.0/17</a>> -o enp2s0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360<br>
> > > COMMIT<br>
> > ><br>
> > > On Mon, 14 Oct 2019 at 11:14, Houman <<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>>>>> wrote:<br>
> > ><br>
> > > Hello Noel,<br>
> > ><br>
> > > Thanks for your solution, I just tried it:<br>
> > ><br>
> > > iptables -I FORWARD 2 -m conntrack --ctstate NEW -m hashlimit --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-upto 5/s -j ACCEPT<br>
> > ><br>
> > > But I got this error message:<br>
> > ><br>
> > > iptables v1.6.1: hashlimit: option "--hashlimit-name" must be specified<br>
> > ><br>
> > > I googled and added the missing name like this:<br>
> > ><br>
> > > iptables -I FORWARD 2 -m conntrack --ctstate NEW -m hashlimit --hashlimit-name NETSCAN --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-upto 5/s -j ACCEPT<br>
> > ><br>
> > > Do you agree with this approach to prevent VPN users from running Netscans?<br>
> > ><br>
> > > Many Thanks,<br>
> > > Houman<br>
> > ><br>
> > ><br>
> > > On Wed, 31 Jul 2019 at 14:51, Noel Kuntze <noel.kuntze@thermi.consulting> wrote:<br>
> > ><br>
> > > Hello Houman,<br>
> > ><br>
> > > A "netscan" attack isn't actually anything worthy of an abuse email.<br>
> > > It's not part of a benign usage pattern of a VPN service, but it itself isn't illegal or anything.<br>
> > > You can only slow down such scans by rate limiting the number of new connections using the hashlimit match module, for example.<br>
> > ><br>
> > > E.g. -A FORWARD -m conntrack --ctstate NEW -m hashlimit --hashlimit-mode srcip --hashlimit-srcmask 32 --hashlimit-upto 5/s -j ACCEPT<br>
> > ><br>
> > > Kind regards<br>
> > ><br>
> > > Noel<br>
> > ><br>
> > > Am 30.07.19 um 16:39 schrieb Houman:<br>
> > > > Sorry I mistyped. I meant Netscan.<br>
> > > ><br>
> > > > The abuse message was saying: *NetscanOutLevel: Netscan detected from xx.xx.xx.xx*<br>
> > > ><br>
> > > > This is possible though, that VPN users run a netscan and scan the ports. Am I correct?<br>
> > > ><br>
> > > > Thanks,<br>
> > > ><br>
> > > > On Tue, 30 Jul 2019 at 15:30, Thor Simon <<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>>> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>>>> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>>> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a> <mailto:<a href="mailto:Thor.Simon@twosigma.com" target="_blank">Thor.Simon@twosigma.com</a>>>>>> wrote:<br>
> > > ><br>
> > > > I don't think netstat does what you think it does. It is a _local_ tool. Perhaps the "abuse notification" you received is a phishing attack?<br>
> > > ><br>
> > > > Hae a look at the manual page:<br>
> > > ><br>
> > > > <a href="http://manpages.ubuntu.com/manpages/trusty/man8/netstat.8.html" rel="noreferrer" target="_blank">http://manpages.ubuntu.com/manpages/trusty/man8/netstat.8.html</a><br>
> > > ><br>
> > > > ________________________________<br>
> > > > From: Houman <<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>>>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a> <mailto:<a href="mailto:houmie@gmail.com" target="_blank">houmie@gmail.com</a>>>>>><br>
> > > > Sent: Jul 30, 2019 10:18 AM<br>
> > > > To: <a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>>> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>>>> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>>> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a> <mailto:<a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a>>>>><br>
> > > > Subject: [strongSwan] How to block Netstat attacks from VPN users?<br>
> > > ><br>
> > > > Hello,<br>
> > > ><br>
> > > > I had an interesting abuse notification that someone has run a netstat through our VPN.<br>
> > > ><br>
> > > > > time protocol src_ip src_port dest_ip dest_port<br>
> > > > > ---------------------------------------------------------------------------<br>
> > > > > Tue Jul 30 13:38:01 2019 UDP 136.243.xxx.xxx 21346 => 172.20.10.17 21346<br>
> > > > > Tue Jul 30 13:38:01 2019 UDP 136.243.xxx.xxx 21346 => 172.20.10.19 21346<br>
> > > ><br>
> > > > I was wondering if there is a good way to block all VPN users from running hacker tools such as netstat (port scanning) altogether. Is there a reliable way to do that with iptables?<br>
> > > ><br>
> > > > I came across this snippet that should block port scans, but I'm not sure if that would block a VPN user after all since the VPN traffic is masqueraded.<br>
> > > ><br>
> > > > iptables -A port-scan -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j RETURN<br>
> > > > iptables -A port-scan -j DROP --log-level 6<br>
> > > > iptables -A specific-rule-set -p tcp --syn -j syn-flood<br>
> > > > iptables -A specific-rule-set -p tcp --tcp-flags SYN,ACK,FIN,RST RST -j port-scan<br>
> > > ><br>
> > > > Any suggestions, please?<br>
> > > > Many Thanks,<br>
> > > > Houman<br>
> > > ><br>
> > > ><br>
> > > ><br>
> > ><br>
> > > --<br>
> > > Noel Kuntze<br>
> > > IT security consultant<br>
> > ><br>
> > > GPG Key ID: 0x0739AD6C<br>
> > > Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C<br>
> > ><br>
> > ><br>
> ><br>
> > --<br>
> > Noel Kuntze<br>
> > IT security consultant<br>
> ><br>
> > GPG Key ID: 0x0739AD6C<br>
> > Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C<br>
> ><br>
> ><br>
><br>
> -- <br>
> Noel Kuntze<br>
> IT security consultant<br>
><br>
> GPG Key ID: 0x0739AD6C<br>
> Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C<br>
><br>
><br>
<br>
-- <br>
Noel Kuntze<br>
IT security consultant<br>
<br>
GPG Key ID: 0x0739AD6C<br>
Fingerprint: 3524 93BE B5F7 8E63 1372 AF2D F54E E40B 0739 AD6C<br>
<br>
</blockquote></div>