I have a vps, which host some service only I used. Today, I found someone scaning my vps by
netstat -ntu | awk '{print $5}' |sort | uniq -c | sort -n
And found some result(I have removed my ip from below)
1 xxxxxxxxxxx:59564
1 xxxxxxxxxxx:59569
1 xxxxxxxxxxx:59570
1 xxxxxxxxxxx:59576
1 120.236.148.199:2226
1 127.0.0.1:41108
1 127.0.0.1:41148
1 127.0.0.1:41156
1 127.0.0.1:41158
1 127.0.0.1:41178
1 127.0.0.1:41180
1 183.61.236.54:3128
1 213.13.37.231:3128
1 218.244.149.184:8888
1 46.164.141.173:8080
1 58.96.172.205:8888
1 Address
1 servers)
2 ::1:9988
2 219.156.157.186:80
10 127.0.0.1:3306
11 127.0.0.1:3999
I have some webservice only for myself, I want to ban all ip once they access other ports, but there are some problems.
I setup a socks5 proxy on 8699, but it seems open some other port to serve my connection:
tcp6 0 0 default.hostname:8699 my_vps_ip_here.bro:59570 ESTABLISHED tcp6 0 0 default.hostname:8699 my_vps_ip_here.bro:59576 ESTABLISHED tcp6 0 0 default.hostname:8699 my_vps_ip_here.bro:59564 ESTABLISHED tcp6 0 0 default.hostname:8699 my_vps_ip_here.bro:59569 ESTABLISHED
netstat -ntu | awk '{print $5}' |sort | uniq -c | sort -n
doesn't shows I am connecting8699
, only shows59570, 59576, 59564, 59569
. What is the correct rule for this case ?What is the recommended way to automatically ban IP? I only come up with: keep check the result of
netstat -ntu | awk '{print $5}' |sort | uniq -c | sort -n
every second, and add bad ip to iptables.I know iptables and ufw can ban ip, ufw looks more like a manager, but is there any better choice ?