With nmap you can see a live system's or server's open, closed, and filtered ports. But how do you make it show as filtered when it is currently shown as open?
nmap can detect three states for a TCP port:
- Open means "SYN" packet got a "SYN/ACK" response ("I hear you, can you hear me?")
- Closed means "SYN" packet got a "RST" response ("Firewall REJECT")
- Filtered means "SYN" packet got no response at all ("Firewall DROP")
The only way to make an open port seem filtered is to use the firewall to drop packets from the sources you want filtered, and allow packets from the sources you want to allow. This will make the open port seem filtered to unauthorized sources. But in order to do that, you need to determine which sources are allowed to connect and configure the firewall rules accordingly.
In other words, you can't have a port be like a "hidden SSID" in wireless, where it's secretly open but you have to know it's there.