nmap "filtered" results on a pretty naked server - could "filtered" just mean "silence"?

Question

I get unintuitive results from "nmap -A " which I want to clarify.

Setup: sshd (ssh deamon service) is successfully running. postfix is installed and so smpt service is running. However, it only configured to send mail, not to receive. apache not installed, iptables empty, ufw not installed.

From this primary nmap documentation source: "Closed ports have no application listening on them"

The Question:

Is it possible that some instances of "filtered" results also simply have no application listening on them? Or does "filtered" always mean there is some other reason? (If it's the latter, I would like to find out what that other reason is, which is why I am asking.)

nmap -A xxxxxx.com

Starting Nmap 7.01 ( https://nmap.org ) at 2018-01-21 18:13 PST
Nmap scan report for xxxxxx.com (45.**.***.***)
Host is up (0.058s latency).
rDNS record for 45.**.***.***: li****-***.members.linode.com
Not shown: 995 closed ports
PORT    STATE    SERVICE      VERSION
22/tcp  open     ssh          OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 **** (RSA)
|_  256 **** (ECDSA)
25/tcp  filtered smtp
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

sudo lsof -i -n

COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd    3396    root    3u  IPv4  15205      0t0  TCP *:ssh (LISTEN)
sshd    3396    root    4u  IPv6  15214      0t0  TCP *:ssh (LISTEN)
master  4988    root   12u  IPv4  19670      0t0  TCP 127.0.0.1:smtp (LISTEN)
master  4988    root   13u  IPv6  19671      0t0  TCP [::1]:smtp (LISTEN)
sshd    5582    root    3u  IPv4  30352      0t0  TCP **.**.***.***:ssh->**.**.***.***:54224 (ESTABLISHED)
sshd    5602 izxzxzn    3u  IPv4  30352      0t0  TCP **.**.***.***:ssh->**.**.***.***:54224 (ESTABLISHED)

sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

Answer 1

These are common ports blocked by internet service providers.

It is impossible to tell if that is your issue from the information provided but 25 is often blocked to limit open spam relays. 135, 139 and 445 are often blocked to protect customers with unintentionally open file shares which used to be very common.

In the case of my home provider, these ports are blocked by default but can be turned off in the customer interface.

If this is a scan over the internet (by the looks of the .com in your nmap command it likely is) then there is almost certainly an ISP blocking access to those ports.

Answer 2

The nmap manual states (emphasis mine):

The state is either open, filtered, closed, or unfiltered. Open means that an application on the target machine is listening for connections/packets on that port. Filtered means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is open or closed. Closed ports have no application listening on them, though they could open up at any time. Ports are classified as unfiltered when they are responsive to Nmap's probes, but Nmap cannot determine whether they are open or closed.

The target host 45.**.***.*** may well be listening on the one or more of port you were probing, but nmap is telling you it has no way of knowing.