Protecting against DDOS attacks

theitmedic — Fri, 21 Feb 2020 19:10:52 GMT

I have a Cisco 2901 router configured to allow access to a DVR device using NAT and ACLs from the Internet. I can't lock down the ACLs to a source IP due the customer's DRV app needing to access the DVR from anywhere out on the Internet. I see port scans happening from various suspicious locations scanning the routers IP, which is hidden, for port 7000. They can't gain access to the DRV device but is there a way to deny port scans from getting to port 7000? Is there something to deny based on scan frequency or possibly seeing no connection establishment to DVR device and then deny source IP?

interface GigabitEthernet0/0
description Internet Outside GigabitEthernet0/0
ip address x.x.x.x 255.255.255.252
ip access-group 190 in

interface GigabitEthernet0/1
description DVR Device
ip address 192.168.4.1 255.255.255.0
ip access-group 104 in

ip nat inside source static tcp 192.168.4.2 35000 interface GigabitEthernet0/0 7000

ip nat inside source route-map NAT_MAP_1 interface GigabitEthernet0/0 overload

oute-map NAT_MAP_1 permit 1
match ip address 100

access-list 100 permit ip 192.168.4.0 0.0.0.255 any
access-list 100 deny ip any any

access-list 104 remark ------ DVR Device IN Rules ------
access-list 104 permit tcp host 192.168.4.2 any eq www
access-list 104 permit udp host 192.168.4.2 any eq domain
access-list 104 permit tcp host 192.168.4.2 eq 35000 any
access-list 104 deny ip any any log

access-list 190 permit tcp any any eq 7000 log

access-list 190 deny ip any any

Thanks

Re: Protecting against DDOS attacks

Jason Kunst — Mon, 21 Oct 2019 10:33:38 GMT

This isn’t the right forum for routing questions, please move to routing platforms

topic Re: Protecting against DDOS attacks in Network Access Control

Protecting against DDOS attacks

Re: Protecting against DDOS attacks