Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them manually. On my Debian server I would like to listen to all my UDP and TCP ports so I can clearly figure out which TCP and UDP ports my university let through their firewall. Nmap is wonderful on the client side to test that, but what should I do on the server side?

share|improve this question
As this appears to represent an unauthorized attempt at circumventing the university's security, I'm voting to close as off-topic. – Iszi Nov 16 '11 at 2:38
5  
Dude. He's only trying to find out what ports are allowed, not changing his grades. – chris Nov 16 '11 at 7:59
1  
Epic reference, chris. – k to the z Nov 16 '11 at 15:38
4  
@Iszi - I can't resist noting that not allowing "... connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123" is hardly a security measure of any effect :-) Or is it? – Martin Nov 16 '11 at 16:02

3 Answers

up vote 4 down vote accepted

Why don't you run a sniffer on the server and make sure it listens only to traffic coming in from a certain IP or network? Then run a tool like ftester and you should be able to tell what ports are allowed.

share|improve this answer
1  
He probably wants to know if he can establish a TCP connexion, not just the initial SYN packet, so he also need to accept() the TCP connexion. – curiousguy Nov 16 '11 at 19:10
solved: tcpdump -nnq src host <campus-external-ip> and not port ssh since the campus firewall is not so advanced, on all ports I discovered I was able to make a full TCP and/or UDP connection. – Michael Nov 16 '11 at 20:26
up vote 7 down vote

A simple and passive solution would be to log all incoming connection attempts to syslog, run your scan, and when you get home look at the logs. With iptables, you can log connections like this:

iptables -A INPUT -p tcp -m state --state new -j LOG --log-prefix "New connection: "

That way, you don't need to run a service that answers all connetion attempts.

share|improve this answer
+1, less complexity than mine and suitable for temporary testing. – Jeff Ferland♦ Nov 16 '11 at 15:00
1  
Addendum thought: Use in tandem with mine and you'll may discover firewall rulesets with differences between inbound and outbound rules (SYN is seen coming in by server, SYN ACK is not seen by client) – Jeff Ferland♦ Nov 16 '11 at 18:42
He probably wants to know if he can establish a TCP connexion, not just the initial SYN packet, so he also need to accept() the TCP connexion. – curiousguy Nov 16 '11 at 19:10
@JeffFerland / curiousguy that'd be interesting, although I wouldn't expect a firewall that wants to prevent outgoing connections, to allow the SYNs in the first place – chris Nov 16 '11 at 19:42
@chris Possible example (the one that prompted my comment): blocking email to prevent spam might be done by preventing any outbound communication to port 25 except for the ISP's servers. SYNs are seen, SYN ACKs back are dropped. Also, accepting a connection with iptables won't matter if there isn't a back-end service for it. – Jeff Ferland♦ Nov 16 '11 at 20:02
show 3 more comments
up vote 6 down vote

Simplistic method:

Use your regular application to list on one port. Use iptables to forward all ports to the open port by means of the dnat module.

iptables -A PREROUTING -i interface -p tcp -j DNAT --to-destination your.ip:port
iptables -A PREROUTING -i interface -p tcp -j DNAT --to-destination your.ip:port
share|improve this answer
"localhost:xxx" would be valid? Also, I already have plenty of rules in the prerouting table, if I write this one in first, the other ones will still work right? – Michael Nov 16 '11 at 1:10
@Michael: not localhost, that will use the loopback interface. Use ifconfig to determine your IP address and use that in Jeff's commands above in place of your.ip. – bstpierre Nov 16 '11 at 1:35
1  
@Michael: "If no IP address is specified then only the destination port will be modified." -- so just the port number will do it. – Jeff Ferland♦ Nov 16 '11 at 1:38
2  
@bstpierre Who wants to spawn 131,070 nc instances? – Jeff Ferland♦ Nov 16 '11 at 1:39
3  
@JeffFerland: Sorry that wasn't clear, I meant combined with your iptables trick -- listen with nc on your.ip:port. – bstpierre Nov 16 '11 at 1:45
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.