Source code and details: https://github.com/umutcamliyurt/PortTripper

How it works

On startup PortTripper:

  1. Scans the configured port range and builds a whitelist of ports already in use by real services (first run only).
  2. Draws a cryptographically random sample of up to -maxports ports from the range, excluding whitelisted ports. Using crypto/rand for selection means the open set is unpredictable to an attacker even if they know the configured range.
  3. Binds TCP and UDP listeners on every chosen port.
  4. On TCP: accepts connections, holds them open for a configurable duration, then drops them, wasting the scanner’s threads and file descriptors.
  5. On UDP: reads and discards datagrams without replying, so ports appear open|filtered to scanners rather than closed.

All real service ports are untouched because they are already bound before PortTripper starts, and the auto-generated whitelist tells PortTripper to skip them.

  • mic_check_one_two@lemmy.dbzer0.comEnglish
    1·
    1 day ago

    My point was that this only really helps if they’re already on your LAN. Ports 80 and 443 (the ports your reverse proxy would use) are functionally useless for an attacker to map. And if they’re already on your LAN, there are honeypots that will do better than simply eating server resources to delay (not stop, just delay) an attacker.

    • atzanteol@sh.itjust.worksEnglish
      1·
      19 hours ago

      I’m not sure you understand what a “honeypot” is. The entire point is to set it up somewhere public so that people try to scan and connect to it. It doesn’t protect anything. It’s designed to try to slow-down attackers who probe random systems.

      • mic_check_one_two@lemmy.dbzer0.comEnglish
        2·
        17 hours ago

        I’m not sure you understand what a honeypot is. You only listed one kind, and it is arguably the most useless kind. I don’t care about what happens outside of my WAN, because that is what a firewall is for. I only care about what happens inside the firewall. A good honeypot will act as an early warning system for a breach. It is an attractive target for people who are looking to spread to other devices on the network.

        If an attacker gets into your network, the honeypot is designed to act as an attractive target and alert you when it gets hit. I don’t care if people try to scan my WAN ports. Bots do that all the time. It’s basically a given. But with a reverse proxy, you’re only opening ports 80 and 443. Those are basically useless for an attacker, because it only tells them that you’re running something on http and https. And that could be anything.

        If I’m running a honeypot, it’s going to be to alert me if something gets breached. It’s going to run on my LAN, not my WAN. If something on my LAN suddenly starts scanning all of my server’s ports, it’s because that thing is a rogue device/attacker. I’m not interested in stalling them. I want to be automatically alerted and to completely shut them out. That’s what a good honeypot will do. A bad honeypot just wastes time and resources, instead of alerting me to the potential breach.

        • atzanteol@sh.itjust.worksEnglish
          1·
          13 hours ago

          But with a reverse proxy, you’re only opening ports 80 and 443. Those are basically useless for an attacker, because it only tells them that you’re running something on http and https. And that could be anything.

          That you seem to think a reverse proxy provides some sort of security is a bit… Terrifying.

          • mic_check_one_two@lemmy.dbzer0.comEnglish
            1·
            9 hours ago

            Nope, it just encrypts your traffic with https to avoid MITM attacks, and allows you to avoid opening more than two ports on your WAN. But if you simply open ports for every service, that’s usually a big easy “I’m running {service}” beacon. If I scan your WAN IP and find port 32400 open, I can make a reasonably safe bet that you’re running plex. But ports 80 and 443 won’t tell me anything about which services you’re running, because those are reserved for http and https traffic specifically. So I’d know that you’re running something, but I wouldn’t simply be able to guess which services specifically.

            Sure, this listed honeypot may be able to help with that by making it appear as if every port is in use. But again, a reverse proxy would accomplish the same thing (without exposing all of your services directly) by simply shrouding all of your services behind 80 and 443.