Best way to block when behind a proxy

[michmoor]

Whats the best way to block a Network Scan if the server is behind a reverse proxy and the source IP would always be the proxy?

I would like to block this but as you can see from the alert i cant as both IPs are local to me but the scan is happening from multiple internet IPs.

[bmeeks]

@michmoor said in Best way to block when behind a proxy:

server is behind a reverse proxy and the source IP would always be the proxy

Your definition of the problem gives you the answer ... .

It can't be done using the IDS/IPS packages available on pfSense (unless you drop the proxy). The IDS cannot see the original IP address.

[michmoor]

@bmeeks was hoping there was some…trickery. But alas it’s reading the IP header so not much can be done

[abtekk]

This post is deleted!