1

The title is really bad, but I was able to find better. I have installed Debian on VMware, and set iptables to block any traffic except port 80 (inbound and outbound). When I run a nmap scan it shows that this port is filtered. Should it be this why or not?

  • What did a Google search turn up for the nmap result of 'filtered'? – schroeder Jul 4 '14 at 16:58
  • I know what filtered means. But the policy for port 80 is accept, this is why I wonder should this be "filtered" or not. – user50410 Jul 4 '14 at 17:03
  • 1
    We get a LOT of people who want us to interpret nmap results for them. It helps us to know what your knowledge level is. Do you have a service responding on that port? – schroeder Jul 4 '14 at 17:35
  • Of course Apache2 I don't have any IDS or IPS only iptables with the policy which I already describe. – user50410 Jul 4 '14 at 17:48
  • Can you successfully browse to your port 80? These might sound like dumb questions, but you're not giving us much to work with. – schroeder Jul 4 '14 at 17:49
2

When nmap scans a TCP port (e.g. TCP/80 for HTTP traffic) a filtered response means that nmap did not get any response to the packet it sent. The other options for TCP ports are "closed" which means that in response to the SYN packet nmap sent, the host sent a RST packet (essentially indicating that there is no service listening on that port) or "open" which means that nmap got an ACK packet back from the port (generally indicating that there is a service on that port which is happy to receive connections).

If you can connect to the webserver on port 80 on the machine in question from another system then that indicates that port 80 is open and receiving connections, so if you carry out an nmap scan from the same machine you browse from, you should have received an open response as the server is there and available for connection.

  • unless you are scanning from host to VM - the networking gets odd and nmap can behave strangely. – schroeder Jul 5 '14 at 1:24
0

Filtered is a loose term when it comes to nmap, in most cases it refers to a firewall guarding it. In some cases these protections may be circumvented. In your case I think it's safe to say that if your config is right, you're safe (on ports other than 80)

  • One more question, is there possible lay to understand if the port is really blocked or not(as in my case) without trying to open connection. – user50410 Jul 4 '14 at 21:17
  • 1
    "Filtered" is a well-defined term when it comes to nmap: it means that when a SYN packet was sent to the port, neither a SYN/ACK nor a ICMP "destination port unreachable" was received in reply. – Mark Jul 4 '14 at 21:29
  • With simple words no way. Thanks for your response – user50410 Jul 4 '14 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.