How can I use nmap to perform operating system detection on a system which has all of its ports filtered by a firewall?

Is there a way to bypass it?

I have tried: syn scan, xmas scan, fragment scan, service version detection (-sV), and nmap nse script scan. When I performed the scans, the reply that I got was the same in all the cases. I cannot provide the exact response but it was something like this: " ****host is up" "all the 1000 ports are filtered****".

  • Insufficient information to go on. If all ports are filtered, how do you know there is anything at that address? If you get no response, there may as well not be. Mar 17, 2016 at 18:10
  • but in the response which i got it said that the "host is up"
    – rats20
    Mar 17, 2016 at 18:17
  • 1
    Did you use -Pn or -PN (same thing)? That tells Nmap that the target is up, regardless of what reality is. Nmap is just taking your word for it. Use --reason to see why it thinks so. Mar 17, 2016 at 21:03

1 Answer 1


The answer depends on what you are targeting to some extent. If there is an Internet-facing port on the host your scan may be blocked by the firewall responding with resets (RST) which makes your initial scan results look closed or filtered even though that may not be entirely true. Firewalls are designed to make this harder and can block some scans but if at least one port is available for testing you have a very good chance of figuring it out.

That said you will have to focus on information like the type and versions of applications running on the system. Use nmap to focus on the ports that are open and increase verbosity and look at the service versions.

nmap -Pn -vvv -sV -p 80 #(webserver) or
nmap -Pn -vvv -sV -p 22 #(ssh, hopefully on another port)

and you will see outputs that include lines like

22/tcp open  ssh     syn-ack OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

This can help you identify the host even if general port scanning will not.

Note: you can also take this a step further by analyzing the protocol traffic itself or content available via the applications exposed.

Additionally an nmap FTP bounce scan can also scan other servers behind a firewall:


nmap -vvv -b -PN :@

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .