If nmap reports a port is open, does that ALSO mean a service is listening on the port?

Question

I have a Thompson TG585v7 router/firewall whose firewall is configured to FORWARD several ports to a computer X54 within the LAN.

These ports are in the range 1024 through to 2500

That X54 computer is now gone and so there is nothing "listening" on those final destination ports

If I use scan the firewalls public IP using

nmap -A -p 1000-2500 219.xxx.xxx.xxx

Output

$ sudo nmap -A -p 1000-2500 219.xxx.xxx.xxx

Starting Nmap 6.40 ( http://nmap.org ) at 2015-02-21 13:14 NZDT
Nmap scan report for dsldevice.lan (219.xxx.xxx.xxx)
Host is up (0.011s latency).
Not shown: 1500 filtered ports
PORT     STATE SERVICE VERSION
1723/tcp open  pptp    THOMSON (Firmware: 1)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: broadband router
Running: Thomson embedded
OS CPE: cpe:/h:thomson:st_585 cpe:/h:thomson:st_536i
OS details: Thomson ST 585 or ST 536i ADSL modem
Network Distance: 1 hop
Service Info: Host: SpeedTouch

It reports other fully functioning - in this case 1723 - ports that are open and have a service listening, but doesn't show these ports that are forwarded to a non-existant machine.

So My question is, if nmap reports that a port is "open", does it mean that both the following is true?

1. the firewall is accepting connections on the given port
2. there is a machine/service listening on the other end

Answer 1

For a SYN scan of the sort you are performing, nmap defines an "open" TCP port as one where a SYN packet sent by nmap elicits an ACK packet from the target system. Assuming that the firewall is configured sensibly, and that the TCP/IP stack is programmed correctly, an "open" port means that yes,

1. the firewall is permitting connections on the given port
2. there is a machine listening on the other end

and additionally

3. there is software on the other end listening for data sent to that port.

If you want a greater degree of certainty, have nmap perform a "connect" scan (-sT). This is a slower technique that establishes a full TCP connection with the target, as opposed to the "halfway-opened" connection of a SYN scan. If a "connect" scan says the port is open, it's open in any meaningful sense of the word.

Answer 2

1. Yes. Although there are situations where an ostensibly open port may not mean that you can communicate with it in a meaningful way.

2. Not necessarily, like you just said, the firewall is waiting to forward those ports. Unless you have changed the firewall to no longer be waiting for data forward, it wont close the ports. You should see errors from this in your firewall logs.

Did you do service enumeration? It should be that NMAP can only guess at what is on the ports by the port numbers themselves. Look over exactly nmap was able to find, versus what it was guessing at. Run NMAP with a higher verbosity level.

You should probably close those ports.