Closing ports except 22 and 443. This dramatically slows down the nmap scans:

-A INPUT -i eth0 -p tcp -m multiport --dports 22,443 -j ACCEPT
-A INPUT -i eth0 -p tcp -j REJECT --reject-with icmp-port-unreachable

If I remove the REJECT rule, nmap is fast.

So how to make other ports look like closed ports without slowing down the nmap?

  • 1
    I'm surprised that this response slows down nmap but I don't get why you worry about the speed that people can do a port scan on your machine. Normally, when (and if) possible, it is best to make it as bad as possible. – Julie Pelletier Apr 27 '17 at 14:46
  • @JuliePelletier, I'm a developer, so it needs to be as good as possible for debugging things. There are some unwanted open ports, I'd like to see them as 'closed' (and at the same speed as without iptables). Can't the iptables just simulate what the OS does when a closed port is scanned? – Velkan Apr 27 '17 at 14:51
  • This is actually supposed to be the same, which is why I find it weird. I don't have time to test it now but will follow your question and probably do some tests tonight. – Julie Pelletier Apr 27 '17 at 15:01
  • @JuliePelletier, it's probably the rejection type. tcp-reset works. – Velkan Apr 27 '17 at 15:05

It's the 'tcp-reset' reject type that does what the OS normally does with the closed ports:

-A INPUT -i ens3 -p tcp -j REJECT --reject-with tcp-reset
  • 2
    to elaborate on "why": "Linux limits the rate of ICMP error packets to each destination. – sourcejedi Apr 27 '17 at 16:15
  • 1
    @sourcejedi, same thing if you remove the limit. The slowdown is probably because of the ICMP error packets themselves. – Velkan Apr 27 '17 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.