I am currently testing some servers that are present behind a firewall. During the scanning I am unable identify which ports are open except port 80.

I have used various switches for Nmap only -Pn works and it outputs that port 80 is open and service is httpd.

Is there any alternative method or tool which I can use to bypass the firewall and identify which ports are open on the servers?

2 Answers 2


When I try to pentest I like to use hping3, which you can install it very easily:

apt-get install hping3

Then for bypassing firewall:

hping3 -S -c 80 -p ++1

If port 25, 53 or 80 is opened, it will give you result as this one:

len=46 ip= ttl=54 DF id=0 sport=25 flags=SA seq=24 win=29200 

len=46 ip= ttl=54 DF id=0 sport=53 flags=SA seq=52 win=29200

len=46 ip= ttl=54 DF id=0 sport=80 flags=SA seq=52 win=29200

If you insist to use nmap, then you should check this: https://pentestlab.blog/2012/04/02/nmap-techniques-for-avoiding-firewalls/

  • Thank you for the answer. I am using hping3 as above but I am not getting any response even on port 80
    – Airbourne
    Commented Dec 26, 2016 at 7:07
  • 1
    Try to play manually using telnet: telnet 80 or 25 or 53 etc.
    – Mirsad
    Commented Dec 26, 2016 at 7:14
  • 1
    How does port scanning the firewall, one port at a time from 1-80 (which is what your command does, but you don't explain) bypass the firewall? Wouldn't nmap provide a better scanning approach?
    – schroeder
    Commented Dec 26, 2016 at 8:46

There are a lot of possibilities for that:

1- No ports are really open other than 80.

2- Firewall is not blocking your IP but it might be evade your results and this only with advanced firewall.

3- NMAP by default scans only 1000 TCP ports and there are other open ports so make sure to scan full TCP & UDP port range.... namp -sU -Pn -p 1-65535 will scan full UDP range.

  • I know that the underlying server is windows so there are certain ports that will be open like smb ports etc.
    – Airbourne
    Commented Dec 26, 2016 at 7:03
  • That depends on the administrator of the firewall if there is a need to open (forward) that ports on the firewall to be accessible from outside or not.
    – Opaida
    Commented Dec 26, 2016 at 9:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .