# SYN-Scan-Firewall
## To block the IP from port scans...
```
./install.sh
```
## /etc/SYN-Scan-Firewall/config.yaml
```
blockDuration: 10m
maxScanAttempts: 5
device: "enp2s0"              # Ethernet Device name  

logging:
  filePath: "/var/log/SYN-Scan-Firewall.log"
  maxSizeMB: 10               # Max log size in megabytes
  backups: 5                  # Number of backup logs to keep
  compressBackups: true       # Whether to gzip old logs
  timestampFormat: "2006-01-02T15:04:05" # Go time format

ignoredPorts:
  - 80    # HTTP
  - 443   # HTTPS
  - 9980  # php -S
  - 631   # CUPS (printing)
  - 9100  # print server ports
  - 53    # DNS
  - 123   # NTP
  - 68    # DHCP client
#  - 22    # SSH

whitelistedIPs:
  - "192.168.10.2"   # own IP
  - "192.168.1.100"  # Example local admin
  - "10.0.0.50"      # Example monitoring server
  - "127.0.0.1"      # Localhost
```