# drop trapped IPs
ipt -A infw_inetbr -m state ! --state ESTABLISHED,RELATED -m recent --rcheck --seconds 180 --reap --name scantrap -j DROP

# trap ports
ipt -A infw_inetbr -p tcp -m multiport --dports ${SCANTRAPS} -j scantrap
ipt -A infw_inetbr -p udp -m multiport --dports ${SCANTRAPS} -j scantrap