I am running a simple webserver on a VPS, the only ports I have open are
- 80 - for HTTP (webserver)
- 12345 - an unusual port for SSH connection to administer server.
I wanted to see how my firewall appears to the rest of the internet so I did an nmap scan using the default SYN
scan.
It told me port 1935 was open on my server - which I doubt is true, netstat shows nothing is listening on that port either, so I did a "full connect" nmap scan to try and get a more "truthful" result, but nmap is still reporting that port is open, can anyone give any idea why that might be?
$ nmap -sT -Pn $(dig +short mydomain.com)
Starting Nmap 6.40 ( http://nmap.org ) at 2016-01-31 14:57 NZDT
Nmap scan report for 159.203.197.95
Host is up (0.058s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE
80/tcp open http
12345 open unknown
1935/tcp open rtmp
Nmap done: 1 IP address (1 host up) scanned in 10.18 seconds
My firewall rules $ sudo iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 12345 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7