How to block TCP22 connections

[SOC_CSG]

Hi everybody

I like to know if there is a way to block incoming connections attemps to port TCP 22.

I have an end-customer which has lots of connections to his public ip range 0.0.0.0/24 to port TCP22 but not hit the vulnerability 40015 (SSH User Authentication Brute-force Attempt) because it neves triggers the child signature 31914 (SSH2 Login Attempt) because there no attempt to connect, it just an scanning.

I'm loooking at DoS Protection, which may works, but I'm not sure what to do in Option/Protection tab. I think I need to configure  at Classified option a DoSProteccion Profile, but I'm lost, I donp't know it is better user FloodProtections or Resources Protection.

Do anybody has resolved this issue?

[santonic]

First use firewall rules to only allow traffic from internet to IPs and services which need to be visible from all internet.

If you need to have TCP 22 (SSH?) open from internet, make sure that it's only from specific sources (if possible).

Once you've closed all not needed ports from internet take a look at:

- IPS profile to detect and block multiple login atempts (brute force) to a server which actually listens on that port,

- Zone Protection (with both Flood and Reconnaissance protection) to protect server and obscure results for scans

[bradk14]

by default, it should be blocked already. if the logs are showing allowed (safe to assume they're SYN timeouts?), you must have a policy  permitting it I imagine.

[santonic]

SYN cookie doesn't change log entry to 'allow'. PA replies with SYN ACK but log entry remains 'drop' if the port isn't open.

[reaper]

depending on what you're seeing exactly you could either create a drop policy or use zone protection's reconnaissance protection: