# drop detected scanner IPs
ipt -A infw_inetbr -m state ! --state ESTABLISHED,RELATED -m recent --rcheck --seconds 180 --hitcount 10 --reap --name scandetect -j DROP