I have a host that is NAT'ed and I have opened a single port in my router so the host is reachable by the external world. I tested if it was reachable by running a service and connecting to it externally.

I stopped the service, but the port is still open on the router. When I run nmap from an external server, it doesn't show that port and ends.

This is how I ran nmap from the external server:

sudo nmap -n -PN -sA x.x.x.x

and it returns:

Nmap done: 1 IP address (0 hosts up) scanned in 0.49 seconds

As far as I know my router blocks icmp requests. So how do I make nmap show unfiltered ports ?

  • What IP is x.x.x.x, your NAT'ed host or your router? – schroeder Aug 6 '13 at 20:15

In order to identify ports being redirected to an internal machine, although the internal machine has not got any service in that port, you can use some type of "firewalking" technique.

This technique basically consists on sending packets with different TTL values in order to try to discover when the packet you sent is "stopped".

You have a NSE script for trying firewalk with NMAP, the original firewalk tool or deeper explanations about firewalking


I have stopped the service, but the port is still open.

Your port is "open" on the router, which only passes traffic on to its destination. If there is nothing listening at the destination (the service is stopped), it is a closed port for all intents and purposes. It's just not a firewalled port.

  • Just to confirm: so in your opinion, the accepted answer is wrong? – Andrew Savinykh Nov 29 '16 at 19:21

By default nmap only scans the most commonly used ports. If your open port is not a common port number, add "-p1-65535" to your command line to scan all ports.

sudo nmap -Pn -sS -p1-65535 hostname

On some NAT/routers, if the port is forwarded, but the service is not running on the destination host, it (port forward) cannot be detected by a port scan (FILTERED). But in most cases it should show up as CLOSED.

  • It keeps saying host is down, although -Pn flag is applied and doesn't produce any output. I started the service and it still refuses to scan because it thinks host is down. I think it is a crap way to assume host is down based on icmp response. – bagavadhar Aug 4 '13 at 7:53

The appropriate nmap command will be

nmap -n -Pn -sS x.x.x.x

The -PN flag doesn't exist for nmap. I think you have made a typo.

There is also no reason for you to use the -sA scan type. From the man page,

This scan is different than the others discussed so far in that it never determines open (or even open|filtered) ports. It is used to map out firewall rulesets, determining whether they are stateful or not and which ports are filtered.

Instead, you should use the -sS scan type.

  • Nope it still doesn't work for me. This is how i ran it. $ sudo nmap -n -Pn -sS x.x.x.x Starting Nmap 5.51 ( nmap.org ) at Nmap done: 1 IP address (0 hosts up) scanned in 0.48 seconds – bagavadhar Aug 4 '13 at 4:19
  • 1
    @ashwin I have re-read your question. You have nothing listening on the port..... Therefore nmap can't tell if your host is up..... – user10211 Aug 4 '13 at 4:44

The command should be:

nmap -nPn -p [port fwded in firewall] [External IP of your host]

-Pn will tell nmap not to do host discovery

You have to use -p and tell nmap which port to test. If it's not 443 or 80, and since all the other ports are blocked, nmap will think the host is down.

Make sure you're using the correct IP. If you don't know it go this website from your host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.