2

I am learning Nmap and a thought occurred to me with regards to a SYN scan...

A SYN scan sends an empty TCP packet with the SYN flag set to illicit a response from the target of either RST, indicating that the port is closed, or SYN/ACK, indicating that the port is open.

If the port is being firewalled by IPTABLES then Nmap is either getting an active REJECT response, or IPTABLES will DROP the packets and not respond at all. Either way, Nmap will designate the port as Filtered and lead one to believe that the port is open.

My question then is...Can you make IPTABLES send back an RST on a filtered port instead of just either REJECTING or DROPPING?

My thought is that if this is possible, then you can fool an Nmap -sS scan into reporting that filtered ports are actually closed.

Thanks for any help with this.

Improve this question

1 Answer 1

Reset to default
2

You can send back a RST with iptables -p tcp [...] -j REJECT --reject-with tcp-reset.

I doubt there is any real value to getting nmap to say a port is "closed" instead of "filtered", though. Mainly it's to get connections refused more quickly, instead of waiting for a timeout (e.g., with -j DROP) or sometimes-unreliable ICMP handling (with the other --reject-with options).

Improve this answer
2
  • An broad-range attacker would just try out the attack without first testing for open ports. A targeted attacker would try hard and wouldn't be fooled by ports vaguely appearing to be closed. The only case where I think it would make a difference is an affordable pentester who would use nmap to see what needs to be tested and would thus omit a service from their testing. Security by obscurity… fooling your friends and not making a difference to your enemies!
    – Gilles 'SO- stop being evil'
    May 11, 2016 at 22:28
  • Thanks for the comments! The IPTABLES example worked like a charm and the insights to the security aspect is great as well! Thanks so much for the help.
    – dlowrie290
    May 11, 2016 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.