SCANTRAPS=137,138,139,445,517,753,819,930,1433,2101,2401,5001,6128,8319,12391

ipt_create_chain scantrap

if [ "$MODE" != "start" ]; then
	ipt -F scantrap
fi

# drop trapped IPs
ipt -A infw_inet -m state ! --state ESTABLISHED,RELATED -m recent --rcheck --seconds 180 --reap --name scantrap -j DROP

# trap ports
ipt -A infw_inet -p tcp -m multiport --dports ${SCANTRAPS} -j scantrap
ipt -A infw_inet -p udp -m multiport --dports ${SCANTRAPS} -j scantrap


# skip established
ipt -A scantrap -m state --state ESTABLISHED,RELATED -j RETURN

# skip 3G admin subnets
for ADM_IP in $ADMIN_IPS; do
	ipt4 -A scantrap -s ${ADM_IP} -j RETURN
done

# flag IP as trapped
ipt -A scantrap -m recent --name scantrap --set -j DROP