How to check if a port can be accessed from the outside

Question

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.

Is that possible at all?

I was relying on a web service I had setup on a machine outside, but I wondered if there's some other way. Is it possible to have a special TCP package sent with a modified header so it will be returned to a different port on the same machine?

EDIT: It's just one port, nmap is not really required.

An example of what I meant by special TCP package: The internal machine starts a TCP connection on port A to the outside but forges "somehow" the package so that the firewall recognizes the connection to the outside is being established from port A but the remote machine answers to port B. So perhaps the firewall assumes the ACK/SYN is the start of a new connection from the outside and treat it like such... would that be even thinkable?

EDIT 2: I've tried using the PORT command of FTP to tell a remote FTP server to send the data to a specific port on a specific machine. I couldn't manage to get it work:

ftp> quote PORT 127,0,0,1,178,148
---> PORT 127,0,0,1,178,148
200 PORT command successful. Consider using PASV.
ftp> get start_main_ws
local: start_main_ws remote: start_main_ws
ftp: setsockopt (ignored): Permission denied
---> PORT 127,0,0,1,155,88
200 PORT command successful. Consider using PASV.

It breaks and it automatically send a different PORT number which just works. It does look promising even though I can't make it work. (by the way this is just a local test as a proof of concept)

Answer 1

No, there's no way to do an external port scan without actually having an external machine.

I would suggest grabbing an Amazon EC2 instance (because it's cheap) and running nmap from it.

Answer 2

Every method you could use to check your external security requires that you have control of an external host. Could you send a special TCP packet - yes, provided you write code that interprets the packet and sends the appropriate response, and that would mean having access to the external system.

There's no need to pay for external hosting as long as you have some sort of internet access independent of your company's links, like an ADSL line, cable modem, etc. Just use nmap over that.

EDIT: Having looked at your edit the answer is a flat no. Firewalls are specifically designed not to allow that sort of thing, that's why they have state tables. If you did ever get anything like that to work then it would mean your firewall vendor has some explaining to do!