ipt_create_chain scandetect

if [ "$MODE" != "start" ]; then
	ipt -F scandetect
fi

# drop detected scanner IPs
ipt -A infw_inet -m state ! --state ESTABLISHED,RELATED -m recent --rcheck --seconds 180 --hitcount 10 --reap --name scandetect -j DROP

# the final rule before DROP is scandetect

# exclude RST packets (and drop)
ipt -A scandetect -p tcp --tcp-flags RST RST -j DROP

# skip 3G admin subnets
for ADM_IP in $ADMIN_IPS; do
	ipt4 -A scandetect -s ${ADM_IP} -j DROP
done

# skip whitelisted subnets
if [ -n "${WHITELIST_IPS+X}" ]; then
	for WL_IP in $WHITELIST_IPS; do
		ipt4 -A scandetect -s ${WL_IP} -j DROP
	done
fi


# flag IP as trapped
ipt -A scandetect -m recent --name scandetect --set -j DROP