Configure iptables to not log certain hits

From: M_F_H (no_one_at_example.com)
Date: 09/02/05 

Date: Thu, 01 Sep 2005 22:15:53 -0400

My Fedora Core 4 firewall logs are filled with annoying attempts
to find an open ports 1026 or 1027. Evidently, they are looking
for unpatched MS IIS servers, which they obviously won't find on
my machine. I would like to stop the logging of their pings. Here
are the options I'm considering:

1. Create a script that would parse my firewall logs for IP
addresses that ping my computer for these ports, then modify the
routing table with a command such as this:

route add -host 123.123.123.123 reject

Doing this would certainly stop their ping attempts, but it also
eliminates all communication with that IP address, such as http
(port 80). Perhaps this is the reason that the manpage
discourages using the routing table as a super-strength firewall.

2. Create a script similar to DenyHosts.py, which parses firewall
logs for ssh login attempts, then uses the DenyHosts
configuration to decide which IP addresses to add to the
/etc/hosts.deny file. In my script, I would parse firewall logs
for IPs that tried to ping me at ports 1026 or 1027, then add
them to /etc/hosts.deny. I do not believe this will stop the log
entries from being made because hosts.deny is consulted only when
an xinet-controlled program is initiated, such as ssh, ftp, etc.

3. Add an iptables command that stops logging events that relate
to port 1026 or 1027. This option appeals to me, but I have one
concern. Supposed an authorized person uses scp to copy files
to/from my machine, and in the process is assigned port 1027 to
form the secure connection. Unless carefully crafted, the
iptables command could result in scp connections not being logged.

So, here are my questions:

1. What iptables command should I use to block the log entries?
Bear in mind that I'm a newbie when it comes to manipulating
netfilter with the iptables command.

2. Is there a way to prevent programs like scp from choosing a
specific port range when establishing a connection?

Relevant Pages

  • SUMMARY: remote printing
    ... lp system we should only need port 515 open through the firewall. ... still not working is to look at the firewall logs while tyring to send print ... Roger Kynaston ... Information Technology Services ...
    (SunManagers)
  • RPC-HTTP Port 1030
    ... something in the firewall logs that I can't figure out, and it just bugs me ... Every so often, though, I see one with a different port number: ... That makes me wonder what it is, and why the RPC proxy is ...
    (microsoft.public.exchange.connectivity)
  • Re: IPCOP newbie
    ... >>> source port and destination port. ... The destination port is the port I chose ... >> Depending on how your set them up, the firewall logs all hits on your ...
    (comp.security.firewalls)
  • Re: Connection to TCP port 1197?
    ... I'm not aware of programs running on this port except some ... I wouldn't bother about it too much. ... My firewall logs are ... Strange, but as you say, I'll just have to ...
    (comp.security.firewalls)
  • network slowness/freez-up since update 10/11
    ... network problems: first the network is slow (even within a few ... network - but not the rest of the system - just locks up (can't ping ... OHCI version 1.0, legacy support ... <Parallel port bus> on ppc0 ...
    (freebsd-current)