State NEW must have SYN flag

e-router

@@ -92,17 +92,18 @@ badips() {
         droplog "BAD" "INPUT"
     fi
     ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto UDP -j END-RESET
-    ${iptables} -A INPUT -i ${wan} -p tcp -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j END-RESET
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $banset src -m conntrack --ctstate NEW --ctproto TCP -j END-RESET
 }
 
 scanips() {
     ipset create -! $scanset hash:ip hashsize 4096 timeout $scanttl maxelem $scanmaxelems
-    ${iptables} -A INPUT -i ${wan} -j SET --add-set $scanset src --exist  --timeout $scanttl
+    ${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j SET --add-set $scanset src --exist  --timeout $scanttl
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j SET --add-set $scanset src --exist  --timeout $scanttl
     if $logscan ; then
         droplog "SCAN" "INPUT"
     fi
-    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j REJECT --reject-with icmp-port-unreachable
-    ${iptables} -A INPUT -i ${wan} -p tcp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j REJECT --reject-with tcp-reset
+    ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto UDP -j END-RESET
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $scanset src -m conntrack --ctstate NEW --ctproto TCP -j END-RESET
 }
 
 white() {
@@ -116,7 +117,7 @@ white() {
         ${iptables} -A FW-FILTERED -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
     done < $confd/WHITE.tcp
     ${iptables} -A INPUT -i ${wan} -p udp -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto UDP -j FW-FILTERED
-    ${iptables} -A INPUT -i ${wan} -p tcp -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto TCP -j FW-FILTERED
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto TCP -j FW-FILTERED
     ${iptables} -A INPUT -i ${wan} -p icmp --icmp-type 8 -m set --match-set $whiteset src -m conntrack --ctstate NEW --ctproto ICMP -j ACCEPT
 }
 
@@ -131,7 +132,7 @@ public() {
         ${iptables} -A FW-PUBLIC -p tcp -m conntrack --ctstate NEW --ctproto TCP --dport $port -j ACCEPT
     done < $confd/PUBLIC.tcp
     ${iptables} -A INPUT -i ${wan} -p udp -m conntrack --ctstate NEW --ctproto UDP -j FW-PUBLIC
-    ${iptables} -A INPUT -i ${wan} -p tcp -m conntrack --ctstate NEW --ctproto TCP -j FW-PUBLIC
+    ${iptables} -A INPUT -i ${wan} -p tcp --syn -m conntrack --ctstate NEW --ctproto TCP -j FW-PUBLIC
 }
 
 cast() {