I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine.

Is that possible at all?

I was relying on a web service I had setup on a machine outside, but I wondered if there's some other way. Is it possible to have a special TCP package sent with a modified header so it will be returned to a different port on the same machine?

EDIT: It's just one port, nmap is not really required.

An example of what I meant by special TCP package: The internal machine starts a TCP connection on port A to the outside but forges "somehow" the package so that the firewall recognizes the connection to the outside is being established from port A but the remote machine answers to port B. So perhaps the firewall assumes the ACK/SYN is the start of a new connection from the outside and treat it like such... would that be even thinkable?

EDIT 2: I've tried using the PORT command of FTP to tell a remote FTP server to send the data to a specific port on a specific machine. I couldn't manage to get it work:

ftp> quote PORT 127,0,0,1,178,148
---> PORT 127,0,0,1,178,148
200 PORT command successful. Consider using PASV.
ftp> get start_main_ws
local: start_main_ws remote: start_main_ws
ftp: setsockopt (ignored): Permission denied
---> PORT 127,0,0,1,155,88
200 PORT command successful. Consider using PASV.

It breaks and it automatically send a different PORT number which just works. It does look promising even though I can't make it work. (by the way this is just a local test as a proof of concept)

  • 2
    as regards your edit - nmap is the simplest tool of choice here. It can be used to test one port, it is free, and it does exactly what you are looking for.
    – Rory Alsop
    Commented Nov 5, 2012 at 11:37
  • @Rory: indeed, I was just implying it's not required, not that it wasn't usable. Just in case somebody has a different idea.
    – estani
    Commented Nov 5, 2012 at 13:03

2 Answers 2


No, there's no way to do an external port scan without actually having an external machine.

I would suggest grabbing an Amazon EC2 instance (because it's cheap) and running nmap from it.

  • Thanks Polynomial it does seem to be impossible... though I'm still not entirely convinced.
    – estani
    Commented Nov 5, 2012 at 13:06

Every method you could use to check your external security requires that you have control of an external host. Could you send a special TCP packet - yes, provided you write code that interprets the packet and sends the appropriate response, and that would mean having access to the external system.

There's no need to pay for external hosting as long as you have some sort of internet access independent of your company's links, like an ADSL line, cable modem, etc. Just use nmap over that.

EDIT: Having looked at your edit the answer is a flat no. Firewalls are specifically designed not to allow that sort of thing, that's why they have state tables. If you did ever get anything like that to work then it would mean your firewall vendor has some explaining to do!

  • I've edited the question so that I hope it's clearer now. The idea would be to alter the TCP package at the internal machine, if that were possible.
    – estani
    Commented Nov 5, 2012 at 13:05
  • I'm still not following your answer. It is because firewalls have a state tables that what I have written might be even possible. If the connection is not in the state table it is regarded as a new and that's exactly what I wanted to emulate (if that would have been possible, that is). In any case I think the answer is a plain no. Thanks.
    – estani
    Commented Nov 5, 2012 at 13:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .