1

With nmap you can see a live system's or server's open, closed, and filtered ports. But how do you make it show as filtered when it is currently shown as open?

  • With the right firewall settings this is possible. Details depend on your specific OS. But note that if a port is filtered (by the firewall) but actually open (some service is accepting data on this port) it will only be open from specific IP addresses or after some magic like port knocking etc, i.e. it is not possible to use it like any other open port. – Steffen Ullrich Jun 13 at 15:16
  • Alrighty, that was well explained. Thanks Steffen. :) – Volkan Erciyas Jun 13 at 16:09
3

nmap can detect three states for a TCP port:

  • Open means "SYN" packet got a "SYN/ACK" response ("I hear you, can you hear me?")
  • Closed means "SYN" packet got a "RST" response ("Firewall REJECT")
  • Filtered means "SYN" packet got no response at all ("Firewall DROP")

The only way to make an open port seem filtered is to use the firewall to drop packets from the sources you want filtered, and allow packets from the sources you want to allow. This will make the open port seem filtered to unauthorized sources. But in order to do that, you need to determine which sources are allowed to connect and configure the firewall rules accordingly.

In other words, you can't have a port be like a "hidden SSID" in wireless, where it's secretly open but you have to know it's there.

| improve this answer | |
  • Thank you for informations, it was very helpful – Volkan Erciyas Jun 13 at 16:04
  • @gowenfawr, addressing 'cannot have a port be like a "hidden SSID" in wireless, where it's secretly open but you have to know it's there': In theory, that's what port knocking would accomplish: The port is secretly open - but appears closed unless you know the knocking combination. – lab9 Jun 13 at 17:47
1

With iptables using REJECT to deny access to a port yields a closed state since the host responds to the initial SYN. Using DROP however causes the host not to respond at all yielding a filtered state when the port is probed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.