I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides
ESTABLISHED packets. The only type of
NEW packets allowed are TCP packets on port 22 and 80 and that's it (no HTTPS on that server).
The result of nmap on the first 2048 ports gives 22 and 80 as open, as I expect. However a few ports appear as "filtered".
My question is: why do port 21, 25 and 1863 appear as "filtered" and the 2043 other ports do not appear as filtered?
I expected to see only 22 and 80 as "open".
If it's normal to see 21,25 and 1863 as "filtered", then why aren't all the other ports appearing as "filtered" too!?
Here's the nmap output:
# nmap -PN 94.xx.yy.zz -p1-2048 Starting Nmap 6.00 ( http://nmap.org ) at 2014-06-12 ... Nmap scan report for ksXXXXXX.kimsufi.com (94.xx.yy.zz) Host is up (0.0023s latency). Not shown: 2043 closed ports PORT STATE SERVICE 21/tcp filtered ftp 22/tcp open ssh 25/tcp filtered smtp 80/tcp open http 1863/tcp filtered msnp
I really don't get why I have 2043 closed ports:
Not shown: 2043 closed ports
and not 2046 closed ports.
Here's an lsof launched on the server:
# lsof -i -n COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME named 3789 bind 20u IPv4 7802 TCP 127.0.0.1:domain (LISTEN) named 3789 bind 21u IPv4 7803 TCP 127.0.0.1:953 (LISTEN) named 3789 bind 512u IPv4 7801 UDP 127.0.0.1:domain sshd 3804 root 3u IPv4 7830 TCP *:ssh (LISTEN) sshd 5408 root 3r IPv4 96926113 TCP 94.xx.yy.zz:ssh->aa.bb.cc.dd:37516 (ESTABLISHED) sshd 5411 b 3u IPv4 96926113 TCP 94.xx.yy.zz:ssh->aa.bb.cc.dd:37516 (ESTABLISHED) java 16589 t 42u IPv4 88842753 TCP *:http-alt (LISTEN) java 16589 t 50u IPv4 88842759 TCP *:8009 (LISTEN) java 16589 t 51u IPv4 88842762 TCP 127.0.0.1:8005 (LISTEN)
(note that Java / Tomcat is listening on port 8009 but that port is DROPped by the firewall)