0

When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.

However I can use HTTP or SSH, so that means those ports are opened, but then... why nmap doesn't detect them as open ports?

Improve this question
4
  • Your question is a little unclear - are you expecting your ports to be open or closed? What does sudo iptables -L -v -n show? What is the result of your nmap scan? Is there anything-else between the client running nmap and the server being scanned?
    – Mark Hillick
    Dec 11, 2012 at 13:13
  • Between the PC and the Backtrack VM there is a router with torrent and SSH ports forwarded to the IP of the PC. However, these ports aren't opened in my iptables (because if they were open, nmap would show them) but iptables is accepting the connection anyway. The same with HTTP, it has to be open because if it wasn't, i wouldn't be writting here right now, however... why nmap doesn't show it?
    – user15194
    Dec 11, 2012 at 13:25
  • nmap doesn't scan all ports by default, just a set of common ports. If you are using more esoteric port numbers nmap won't necessarily be looking for them, either add your known port numbers or scan from 1-65535
    – GdD
    Dec 11, 2012 at 13:35
  • Please add your nmap command line! We cannot determine what is wrong unless you tell us what you actually did.
    – schroeder ♦
    Dec 11, 2012 at 18:13

3 Answers 3

Reset to default
1

Are you denying outbound or only inbound? My memory of linux IP tables is a bit rusty, but it sounds like your inbound is deny all while your outbound is permissive. Basically, the most common mode is that any external system requesting in (which is what nmap checks) will be denied, but if an internal connection makes a request out, it is permitted. It is also worth noting that ports are asymmetric. Just because you connect to a web server on port 80 does not mean that the connection back to your computer is on port 80. It is fairly typical for random high number ports to be used for establishing connections. The port numbers like 80 are used to give a common point to connect to.

Improve this answer
1

By default iptables does not block any connections. Also if you use http or ssh it will block those connections unless you explicitly drop inbound without allowing established or related connections.

If you are running these services they should be discoverable. Otherwise you scanned in a wrong way or the services aren't running.

Improve this answer
0

You're talking out to the Internet from your PC with a destination port of port 80. You are scanning from the BT VM with a destination of port 80 BUT in the opposite direction.I suspect that your router doesn't allow port 80 inbound to your PC and I hope this is the case :)

Therefore, your nmap scan from the BT VM will be rejected. As previously said, nmap only scans the 1000 most popular ports by default, although port 80 is included in that list.

My recommendation would be to run nmap locally on your PC (targeting 127.0.0.1) and compare the results.

Improve this answer
5
  • I've scanned all ports locally, and now I see my custom ssh port, also the torrent port, but still I don't see the port 80 for http. I see a unknown port that I don't know which service is using it, maybe http?
    – user15194
    Dec 11, 2012 at 16:24
  • If it's a known http service, nmap will be able to fingerprint it if you're running nmap with "-A" or "-sV". Did you run the iptables command I mentioned earlier? By default, the three default iptables chains are set to ACCEPT.
    – Mark Hillick
    Dec 11, 2012 at 16:49
  • @yzT Why do you expect to see port 80?
    – schroeder ♦
    Dec 11, 2012 at 18:16
  • 1
    @schroeder because there's a mis-understanding in how traffic flows afaics. yzT said "The same with HTTP, it has to be open because if it wasn't, i wouldn't be writting here right now,", i.e. he has port 80 open outgoing.
    – Mark Hillick
    Dec 11, 2012 at 20:49
  • 1
    A little Socratic method never hurt anyone :)
    – schroeder ♦
    Dec 11, 2012 at 20:56

You must log in to answer this question.