9

I rent a server, and my provider seems to be blocking nmap. Is there any other tools I could use to test my home network from the outside?

Also, does blocking nmap on a network provide any security?

EDIT:

If I try:

nmap scanme.nmap.org - I get: 1 IP address (0 hosts up) scanned in 0.50 seconds

nmap -sT -P0 -p 80 scanme.nmap.org - works

nmap -sT -p 80 scanme.nmap.org - doesn't work

Also, only -sT (TCP connect works), SYN scanning (-Ss) doesn't work.Seems like this could be some type of egress filtering.

Improve this question
3
  • 6
    Please describe the "blocking" behavior. What Nmap command did you run, what was the result, and what did you expect? Most likely they are not "blocking nmap" explicitly, but doing something else that is affecting your scan.
    – bonsaiviking
    Mar 25, 2013 at 19:27
  • Without knowing what leads you to refer to it as blocked, this isn't answerable. Please provide more details about what you saw, then flag it for re-opening.
    – Jeff Ferland ♦
    Mar 25, 2013 at 19:52
  • That is the expected behavior. Your provider is not blocking anything.
    – bonsaiviking
    Mar 25, 2013 at 20:15

6 Answers 6

Reset to default
4

nmap scanme.nmap.org - I get: 1 IP address (0 hosts up) scanned in 0.50 seconds

It seems they block SYN TCP requests to uncommon ports. Is there a workaround for this?

It sounds to me like they're blocking ping instead, and by default nmap will only start a scan on a host that responds to ping. Try nmap -sT -P0 -p 80 to see how it reacts since we know 80 is open. Then try nmap -sT -p 80 and see if it reacts differently.

This might be happening at your edge router rather than your ISP. Some of them don't respond to ping by default.

Improve this answer
3
  • Thanks for the suggestion Jeff. nmap -sT -P0 -p 80 shows host is up. nmap -sT -p 80 shows host is down. ping however, works correctly.
    – marcwho
    Mar 25, 2013 at 20:40
  • Also SYN scanning doesn't work (-sS), only TCP connect scans work, -sT
    – marcwho
    Mar 25, 2013 at 20:53
  • In a strange way, that's "unpossible", because a SYN scan relies on the returning ACK, and you can't have a full connect() without having the returning ACK for that too.
    – Jeff Ferland ♦
    Mar 25, 2013 at 21:47
4

If your provider filtering device (ids,end-point protection) has detected some kind of malicious traffic generated from your home-network; that rule (blocking) of namp may be linked in that case. Or sometimes these devices have auto rules to block in case of recon attacks. The traffic from home-network is more of a client-> internet requests ; devices that just analyzes behavior get cautious as they see now inbound traffic generated towards the home-network. Anyhow, you should take this matter with the provider.

As to scan the home-network have you tried an online solution?

  1. http://nmap.online-domain-tools.com/
  2. http://www.seomastering.com/port-scanner.php

If the results still fail it means its not just you; its just the signature that get caught by the filtering device and gets blocked.

Improve this answer
4

Try changing the source port nmap uses?

nmap -g 80 <target>

You might find that the firewall allows the scans on other ports.

Improve this answer
1
  • This might work! I'd also try port 88 or ports 9100-9107 since Kerberos and printer traffic are likely to be hole-punched through any interfering proxy or fireall.
    – atdre
    Mar 10, 2015 at 18:39
3

Blocking nmap is a very concerning. Whoever put this policy into play doesn't have a functional understanding of security because they are making it difficult for you to test your own firewall (doah!). You can probably build nmap from source in your home directory, or you can use netcat (which is installed by default on many *nix distributions):

nc -z google.com 0-65535
Improve this answer
5
  • It seems that netcat just hangs there. If I try any ip other than local, I get no reply. I am able to ping out, but can't port scan. I have checked my iptables rules and OUTPUT is allowed. Could this be their network blocking all port scans, how is this possible?
    – marcwho
    Mar 25, 2013 at 17:29
  • 1
    @marcwho netcat is reallllly slow compared to nmap. You should leave it for a few hours.
    – rook
    Mar 25, 2013 at 17:33
  • Sounds like they may have implemented Egress Filtering.
    – Joe Gatt
    Mar 25, 2013 at 17:42
  • @Joe Gatt when I try: nmap -Pn -p 1-65535 scanme.nmap.org, I get: Nmap done: 1 IP address (0 hosts up) scanned in 0.48 seconds. However, I am able to ping scanme.nmap.org. Could they be blocking certain TCP SYN requests?
    – marcwho
    Mar 25, 2013 at 19:48
  • Ping or ICMP is a different protocol than TCP. It is entirely possible that they are using egress filtering to restrict outbound TCP traffic while allowing ICMP.
    – Joe Gatt
    Mar 25, 2013 at 23:53
1

Are you actually able to make any outgoing TCP-connections? From what you're writing it seems like they're blocking outgoing SYN-packets.

Can you make outgoing connections on port 80 or 443? They might filter "uncommon" ports. Blocking outgoing packets doesn't really provide much security, if they allow port 80 or 443. However, it might create some noise if customers run outgoing nmap-scans on various targets.

In addition to nc, you can also try good old telnet:

$ telnet your-ip [port]

Improve this answer
0

Seems like there is something blocking your egress traffic. Are you configured to use a proxy, such as a web-protection proxy? Try sending HTTP/TLS packets through it with ProxyChains -- https://github.com/rofl0r/proxychains-ng/ -- but using only connection-oriented and non-pinging Nmap flags (i.e., -Pn -sT). Does the traceroute (i.e., --traceroute) Nmap flag work? What does it show?

If there is a NGFW, UTM device, or IPS blocking your traffic, consider using SniffJoke. It's purpose built for these situations. If you sat there for hours with socat, dnscat, nmap, SniffJoke, Wireshark, and a remote server then you would probably be able to figure out what is going on. Without being there myself, this is the best I can recommend.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.