Re: how nmap can know my firewalled servers ?



Hi

you are scanning your machine from the "inside". block localhost with iptables
(i dont know if that is possible).
if you want to know which ports are really reachable from the internet you
have to run nmap from another machine and scan over the internet by entering
the IP of your machine. (e.g. 87.133.35.76).

I am assuming you are using a DROP rule on your firewall. NMAP knows
that if it does not receive a response for a TCP connection then it is
firewalled. Dropping traffic at a firewall violates RFC and makes it
much easier to know when there is a firewall between the scanner and the
end host. I recommend using REJECT

-A INPUT -j REJECT --reject-with icmp-host-unreachable

That will conform to RFC (I'm pretty sure) and will make it harder to
detect a firewall with NMAP.

True, I am using DROP state on my iptables, but even when I changed
the state of my firewall to "REJECT --reject-with
icmp-host-unreachable" - nmap _still_ knows that my services are
running (telnet) and are filtered !

linux:/ # iptables -A INPUT -p tcp --dport 23 -j REJECT --reject-with
icmp-host-unreachable
linux:/ # nmap localhost

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-04-13 12:59
GMT+2 Interesting ports on localhost (127.0.0.1):
(The 1648 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE
22/tcp open ssh
23/tcp filtered telnet
...

linux:/ # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- anywhere anywhere tcp
dpt:telnet reject-with icmp-host-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination


So how do I fool nmap that my service is really down ?

-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------



Relevant Pages

  • Re: [kde] Im feeling paranoid - with good reason.
    ... There should be a script in /etc/rc.d/init.d that starts iptables and loads ... the ruleset in /etc/sysconfig/iptables. ... Things like suse2 firewall. ... Check for open ports by running nmap localhost. ...
    (KDE)
  • IPTABLES Question
    ... I have what I think is a Noob IPTABLES question. ... This appears to work for the game ports only AFTER I reboot the firewall. ... Again, doing this on the fly is crucial to the way I run, a firewall reboot ...
    (linux.redhat)
  • Re: Gui for configuring NTP
    ... >>> behind a firewall that does not have these ports opened. ... As I became more proficient with iptables and trimmed cruft (and used ... The medium hard part is opening a specific second hole to a single address "out there" using the trusted machine acccess to get in so I can perform the tweak. ...
    (Fedora)
  • Re: is it rational to close the 139 port
    ... You use iptables to reject all connections. ... the services on ports 22 and 80 become unavailable, ... You now poke two holes in the firewall to reverse what you did in 2. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • RE: Cannot set up 3rd-party ftp server on VISTA
    ... so no ports to be set there I suppose. ... And even when turning off the McAfee firewall, ... Have you tried connecting to the FTP server from the LAN side? ...
    (microsoft.public.windows.vista.networking_sharing)