Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.

However I can use HTTP or SSH, so that means those ports are opened, but then... why nmap doesn't detect them as open ports?

share|improve this question
Your question is a little unclear - are you expecting your ports to be open or closed? What does sudo iptables -L -v -n show? What is the result of your nmap scan? Is there anything-else between the client running nmap and the server being scanned? – Mark Hillick Dec 11 '12 at 13:13
Between the PC and the Backtrack VM there is a router with torrent and SSH ports forwarded to the IP of the PC. However, these ports aren't opened in my iptables (because if they were open, nmap would show them) but iptables is accepting the connection anyway. The same with HTTP, it has to be open because if it wasn't, i wouldn't be writting here right now, however... why nmap doesn't show it? – yzT Dec 11 '12 at 13:25
nmap doesn't scan all ports by default, just a set of common ports. If you are using more esoteric port numbers nmap won't necessarily be looking for them, either add your known port numbers or scan from 1-65535 – GdD Dec 11 '12 at 13:35
Please add your nmap command line! We cannot determine what is wrong unless you tell us what you actually did. – schroeder Dec 11 '12 at 18:13

3 Answers

up vote 1 down vote

Are you denying outbound or only inbound? My memory of linux IP tables is a bit rusty, but it sounds like your inbound is deny all while your outbound is permissive. Basically, the most common mode is that any external system requesting in (which is what nmap checks) will be denied, but if an internal connection makes a request out, it is permitted. It is also worth noting that ports are asymmetric. Just because you connect to a web server on port 80 does not mean that the connection back to your computer is on port 80. It is fairly typical for random high number ports to be used for establishing connections. The port numbers like 80 are used to give a common point to connect to.

share|improve this answer
up vote 1 down vote

By default iptables does not block any connections. Also if you use http or ssh it will block those connections unless you explicitly drop inbound without allowing established or related connections.

If you are running these services they should be discoverable. Otherwise you scanned in a wrong way or the services aren't running.

share|improve this answer
up vote 0 down vote

You're talking out to the Internet from your PC with a destination port of port 80. You are scanning from the BT VM with a destination of port 80 BUT in the opposite direction.I suspect that your router doesn't allow port 80 inbound to your PC and I hope this is the case :)

Therefore, your nmap scan from the BT VM will be rejected. As previously said, nmap only scans the 1000 most popular ports by default, although port 80 is included in that list.

My recommendation would be to run nmap locally on your PC (targeting 127.0.0.1) and compare the results.

share|improve this answer
I've scanned all ports locally, and now I see my custom ssh port, also the torrent port, but still I don't see the port 80 for http. I see a unknown port that I don't know which service is using it, maybe http? – yzT Dec 11 '12 at 16:24
If it's a known http service, nmap will be able to fingerprint it if you're running nmap with "-A" or "-sV". Did you run the iptables command I mentioned earlier? By default, the three default iptables chains are set to ACCEPT. – Mark Hillick Dec 11 '12 at 16:49
@yzT Why do you expect to see port 80? – schroeder Dec 11 '12 at 18:16
1  
@schroeder because there's a mis-understanding in how traffic flows afaics. yzT said "The same with HTTP, it has to be open because if it wasn't, i wouldn't be writting here right now,", i.e. he has port 80 open outgoing. – Mark Hillick Dec 11 '12 at 20:49
1  
A little Socratic method never hurt anyone :) – schroeder Dec 11 '12 at 20:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.