I am learning Nmap and a thought occurred to me with regards to a SYN scan...
A SYN scan sends an empty TCP packet with the SYN flag set to illicit a response from the target of either RST, indicating that the port is closed, or SYN/ACK, indicating that the port is open.
If the port is being firewalled by IPTABLES then Nmap is either getting an active REJECT response, or IPTABLES will DROP the packets and not respond at all. Either way, Nmap will designate the port as Filtered and lead one to believe that the port is open.
My question then is...Can you make IPTABLES send back an RST on a filtered port instead of just either REJECTING or DROPPING?
My thought is that if this is possible, then you can fool an Nmap -sS scan into reporting that filtered ports are actually closed.
Thanks for any help with this.