Simple little rule to drop XMAS (All flags in a TCP Packet Set, hence “lit up like an Xmas tree!”) and NULL port scans (No flags set).

iptables -t nat -A PREROUTING -p tcp –tcp-flags ALL ALL -j DROP
iptables -t nat -A PREROUTING -p tcp –tcp-flags ALL NONE -j DROP

You can add these rules to a seperate chain for TCP if you have a high traffic firewall. More information on chains here.