I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need.
But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further?
As I said, I'm actually using arno-iptables-firewall, but as that is difficult to 'debug' (it is very complex), I'm providing an example of the problem with a very simple demo 'firewall' (without arno), which should do the job, but apparently isn't:
$ iptables -A INPUT -p tcp --destination-port 1863 -j DROP $ iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1863 Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
nmap example.com -p1863 (from another host) still shows
host is up (0.019s latency). PORT STATE SERVICE 1863/tcp open msnp
UPDATE: OK nmap from different hosts says different things(!). nmap from somewhere else on internet (but within the same VM hosting company's network) shows the ports closed, as they should be, and telnet from these hosts does not work. But from my office ADSL connection, the ports are open and telnet connects (then gets 'closed by foreign host' shortly after).
CONCLUSION: Having now tested from 6 places on the internet, I can only reproduce this behaviour from my office ADSL. I conclude that it is an issue with local routers or our ISP. Thank you to everybody who helped me dig deeper into this issue - I learnt a lot!