I am running a simple webserver on a VPS, the only ports I have open are
- 80 - for HTTP (webserver)
- 12345 - an unusual port for SSH connection to administer server.
I wanted to see how my firewall appears to the rest of the internet so I did an nmap scan using the default
It told me port 1935 was open on my server - which I doubt is true, netstat shows nothing is listening on that port either, so I did a "full connect" nmap scan to try and get a more "truthful" result, but nmap is still reporting that port is open, can anyone give any idea why that might be?
$ nmap -sT -Pn $(dig +short mydomain.com)
Starting Nmap 6.40 ( http://nmap.org ) at 2016-01-31 14:57 NZDT Nmap scan report for 22.214.171.124 Host is up (0.058s latency). Not shown: 997 filtered ports PORT STATE SERVICE 80/tcp open http 12345 open unknown 1935/tcp open rtmp Nmap done: 1 IP address (1 host up) scanned in 10.18 seconds
My firewall rules $ sudo iptables -S
-P INPUT DROP -P FORWARD DROP -P OUTPUT ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 12345 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7