2

I use NMAP to perform port scanning, e.g., TCP SYN scan: nmap -sS 192.168.0.12.

I've two virtual machines running Windows XP and Windows 7, respetively. These have several services running, e.g., port 445.

However, if the Windows software-based firewall is enabled, then NMAP reports filtered for all well-known ports, even thus they are in fact open. If I disable the firewall, then NMAP reports all ports correctly.

Have I done anything wrong? What is the purpose of port scanning, if a simple software-based firewall makes it useless? Should a network administrator modify firewall rules to reflect real-world scenario, i.e., web server, before I would see the open ports in the result set?

  • Have you checked the firewall rules and the logs from the scan time? I.e. is the firewall set to block directory services (port 445) external connections? Can you actually connect to 445 with a legitimate client with the firewall up? – Hector Jan 16 '18 at 11:01
  • @Hector - I haven't checked this. It is a clean install - no modifications. – Shuzheng Jan 16 '18 at 11:11
3

In this case the firewall isn't blocking the port scan (although some firewall products do attempt to detect and block scans). It is actually blocking the service from being available externally. The port scan can't see it because to the external world it is not there.

The port reports filtered because the firewall drops the incoming SYN rather than reply to it.

Port 445 is used for Microsoft Directory Services - which is part of the underlying mechanism for File and Printer Sharing. Were you to enable the "File and Printer Sharing (SMB-In)" Allow rule you would likely find the port started to show up.

  • So, the services are only available to the local machine, and cannot be accessed externally? How do I enable the SMB-In? – Shuzheng Jan 16 '18 at 11:23
  • @Shuzheng That question is easily googled and more of a serverfault question than here. On my Windows 7 machine Start -> type "Firewall" -> "Windows Firewall with Advanced Security on Local Computer" -> Inbound Rules -> "File and Printer Sharing (SMB-In)" -> Right click -> Enable. – Hector Jan 16 '18 at 11:26
  • Thank you - last question: why would “File and Printer Sharing” be useful, if only allowed to run locally? – Shuzheng Jan 16 '18 at 11:54
  • @Shuzheng No idea - maybe internally local printing routes through the same mechanisms. In either case your average home user doesn't use it so it makes sense to firewall it off. Meanwhile for most organizations this would be enabled via group policy as required. – Hector Jan 16 '18 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.