Approach to (nmap?) port scan a subnet over VPN? (updated with figure)

Question

I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server.

I want to do a port scan, indicated by the red arrow. The ports should appear to be closed when scanned from any other place than the jump host (due to firewall rules, in Azure - Network Security Group rules).

I want to test that nodes connected to the VPN gateway should be able to reach the jump host, but nothing else. The reason we want to test this is that we are using Azure technology that is new to us (firewall rules implemented by Network Security Groups). It's a proof of concept project.

What I discovered is that I cannot scan these directly with nmap from my local machine, because the VPN is treated like a PPP connection/dialup interface in windows. E.g. see http://seclists.org/nmap-dev/2006/q3/438.

I am looking for input suggestions on how to proceed.

Answer 1

I seem to have found a solution. Although it seems Npcap is not fully supporting PPP connections, I was able to use the --unprivileged option, in combination with skipping the ping probe using the -Pn option in nmap. In this case, this seems to suffice for the task I have at hand, although it is not fully clear to me what I might be missing when using the unprivileged mode.

For completeness I am adding the description of these:

--privileged (Assume that the user is fully privileged) Tells Nmap to simply assume that it is privileged enough to perform raw socket sends, packet sniffing, and similar operations that usually require root privileges on Unix systems. By default Nmap quits if such operations are requested but geteuid is not zero. --privileged is useful with Linux kernel capabilities and similar systems that may be configured to allow unprivileged users to perform raw-packet scans. Be sure to provide this option flag before any flags for options that require privileges (SYN scan, OS detection, etc.). The NMAP_PRIVILEGED environment variable may be set as an equivalent alternative to --privileged.

--unprivileged (Assume that the user lacks raw socket privileges) This option is the opposite of --privileged. It tells Nmap to treat the user as lacking network raw socket and sniffing privileges. This is useful for testing, debugging, or when the raw network functionality of your operating system is somehow broken. The NMAP_UNPRIVILEGED environment variable may be set as an equivalent alternative to --unprivileged.