Drop or reject: what a firewall tells a scanner

The idea

A Firewall that blocks can drop the packet and stay silent, or reject it and say no; drop vs reject, a scanner learns something from either. Here the scanner probes webServer through firewallRouter, whose rules you write.

Steps

1. Scan the server with nothing in the way

   An attacker maps a network by scanning it, so first see what a scan reports when nothing is in the way. nmap sends a SYN to each Port and names the port by what comes back. The web server listens on 80 and 443; nothing listens on 22.

   scanner:~# nmap -Pn -p 22,80,443 webServer.lab

2. Drop port 80

   Silence is the first way to block: the sender gets nothing back to learn from. Make firewallRouter throw away every packet to port 80, without a word. iptables' FORWARD chain holds the rules for packets it passes on.

   firewallRouter:~# iptables -A FORWARD -p tcp --dport 80 -j DROP
   scanner:~# curl -sS -m 5 http://webServer.lab/
   scanner:~# nmap -Pn -p 80 webServer.lab