1

I am running a simple webserver on a VPS, the only ports I have open are

  • 80 - for HTTP (webserver)
  • 12345 - an unusual port for SSH connection to administer server.

I wanted to see how my firewall appears to the rest of the internet so I did an nmap scan using the default SYN scan.
It told me port 1935 was open on my server - which I doubt is true, netstat shows nothing is listening on that port either, so I did a "full connect" nmap scan to try and get a more "truthful" result, but nmap is still reporting that port is open, can anyone give any idea why that might be?

$ nmap -sT -Pn $(dig +short mydomain.com)

Starting Nmap 6.40 ( http://nmap.org ) at 2016-01-31 14:57 NZDT
Nmap scan report for 159.203.197.95
Host is up (0.058s latency).
Not shown: 997 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
12345    open   unknown
1935/tcp open   rtmp

Nmap done: 1 IP address (1 host up) scanned in 10.18 seconds

My firewall rules $ sudo iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 12345 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
Improve this question

1 Answer 1

Reset to default
2

I wanted to see how my firewall appears to the rest of the internet so I did an nmap scan...

Which means that you did not really scan solely your VPS, but that you have checked out the combination of your VPS and your testing system and lots of routers and maybe even firewalls in between. And of course the VPS is only a virtual system on some real hardware which again has a network stack.

This means that what you see might not fully reflect your VPS. It might show up ports as open which are not open on your VPS but gets intercepted somewhere in between. It might show up ports as closed which are actually open at your VPS because some other device/software is filtering the access.

Improve this answer
3
  • thanks, thats a great point I didnt think of. In that case I will try provisioning a VPS in the same datacentre and repeat the scan - hopefully that will eliminate "interference" in the results
    – the_velour_fog
    Jan 31, 2016 at 9:00
  • @the_velour_fog: your VPS is still a virtual system inside some real hardware with its own network stack and settings. And if you setup the VPS in the same data center only there is no guarantee that it is on the same host as the other VPS, so more intermediate systems (host hardware, router...) are involved. Thus it eliminates some interferences but not all.
    – Steffen Ullrich
    Jan 31, 2016 at 9:12
  • thanks, thats what I was thinking too. In order to try narrow down I just now performed 2 more scans. 1. from another VPS on the same datacenter result (-sT scan) - 1935/tcp filtered rtmp 2. From the VPS itself (-sS scan) result: 1935/tcp closed rtmp - Unless there were any other suggestions to cause, I would take it that you were right about there being some intermediary node as the cause.
    – the_velour_fog
    Jan 31, 2016 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .