2

I use NMAP to perform port scanning, e.g., TCP SYN scan: nmap -sS 192.168.0.12.

I've two virtual machines running Windows XP and Windows 7, respetively. These have several services running, e.g., port 445.

However, if the Windows software-based firewall is enabled, then NMAP reports filtered for all well-known ports, even thus they are in fact open. If I disable the firewall, then NMAP reports all ports correctly.

Have I done anything wrong? What is the purpose of port scanning, if a simple software-based firewall makes it useless? Should a network administrator modify firewall rules to reflect real-world scenario, i.e., web server, before I would see the open ports in the result set?

Improve this question
2
  • Have you checked the firewall rules and the logs from the scan time? I.e. is the firewall set to block directory services (port 445) external connections? Can you actually connect to 445 with a legitimate client with the firewall up?
    – Hector
    Commented Jan 16, 2018 at 11:01
  • @Hector - I haven't checked this. It is a clean install - no modifications.
    – Shuzheng
    Commented Jan 16, 2018 at 11:11

1 Answer 1

Reset to default
3

In this case the firewall isn't blocking the port scan (although some firewall products do attempt to detect and block scans). It is actually blocking the service from being available externally. The port scan can't see it because to the external world it is not there.

The port reports filtered because the firewall drops the incoming SYN rather than reply to it.

Port 445 is used for Microsoft Directory Services - which is part of the underlying mechanism for File and Printer Sharing. Were you to enable the "File and Printer Sharing (SMB-In)" Allow rule you would likely find the port started to show up.

Improve this answer
4
  • So, the services are only available to the local machine, and cannot be accessed externally? How do I enable the SMB-In?
    – Shuzheng
    Commented Jan 16, 2018 at 11:23
  • @Shuzheng That question is easily googled and more of a serverfault question than here. On my Windows 7 machine Start -> type "Firewall" -> "Windows Firewall with Advanced Security on Local Computer" -> Inbound Rules -> "File and Printer Sharing (SMB-In)" -> Right click -> Enable.
    – Hector
    Commented Jan 16, 2018 at 11:26
  • Thank you - last question: why would “File and Printer Sharing” be useful, if only allowed to run locally?
    – Shuzheng
    Commented Jan 16, 2018 at 11:54
  • @Shuzheng No idea - maybe internally local printing routes through the same mechanisms. In either case your average home user doesn't use it so it makes sense to firewall it off. Meanwhile for most organizations this would be enabled via group policy as required.
    – Hector
    Commented Jan 16, 2018 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .