How can I port scan a host from itself without using the loopback interface?

Question

I'm trying to audit firewall rules on a host. This is typically pretty straightforward to do with nmap or a similar scanning tool. The problem is that I can only run the audit on the host itself. Normally, if you run a port scan with nmap against the current host, nmap will use the loopback interface. This is a problem because the firewalls on the hosts that I care about allow all traffic on the loopback interface:

[my-host ~][I]% sudo iptables -vL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
[...snip...]
2364K  123M ACCEPT     all  --  lo     any     anywhere             anywhere
[...snip...]

And consequently, when I scan the host, all ports appear to be allowed by the firewall:

[my-host ~][I]% sudo nmap -sA my-host 

Starting Nmap 6.40 ( http://nmap.org ) at 2020-01-28 13:53 MST
Nmap scan report for my-host (172.20.48.30)
Host is up (0.000015s latency). 
rDNS record for 172.20.48.30: my-host
All 1000 scanned ports on my-host (172.20.48.30) are unfiltered

Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

So I tried specifying the interface to use, hoping to force the scan to route traffic through the host's normal network interface. But nmap can't find any open ports:

[my-host ~][I]% sudo nmap -sA my-host -e ens192 -Pn

Starting Nmap 6.40 ( http://nmap.org ) at 2020-01-28 13:54 MST
Nmap done: 1 IP address (0 hosts up) scanned in 0.44 seconds

However, I know that, in its firewall, the host allows at least port 22 from any other host on the same network. When I scan it from another host on the same network, that is what I see:

[my-other-host ~][I]% sudo nmap -sA my-host -Pn

Starting Nmap 6.40 ( http://nmap.org ) at 2020-01-28 13:55 MST
Nmap scan report for my-host (172.20.48.30)
Host is up (0.00021s latency).
rDNS record for 172.20.48.30: my-host
Not shown: 999 filtered ports
PORT   STATE      SERVICE 
22/tcp unfiltered ssh
MAC Address: 00:50:56:A0:34:4D (VMware)

Nmap done: 1 IP address (1 host up) scanned in 4.51 seconds

So why can I not see these results when scanning my-host from itself? Is this due to the router configuration (which unfortunately I don't have access to), or am I making a mistake somewhere?

Answer 1

The problem is that the Linux routing tables always route traffic locally through the loopback interface and do not put it on the physical network if the local system has a network interface listening for the destination IP address. You can see the local routing table with ip route show table local - all packets matching a rule in the local routing table are looped back. Additionally, the local routing table is automatically maintained (rules are added/removed when bringing interfaces up/down) and cannot be manually altered. Therefore the nmap scanning packets will always end up on the loopback interface (and effectively miss the firewall) even when explicitly specifying the interface to bind to.

The solution is to create a namespaced virtual network to run the scan from. A namespaced virtual network has its own virtual network interfaces and routing tables separate from other namespaced networks, including the root network namespace. This means that packets sent across namespaces appear to come from an external network and are not considered local packets.

I followed the guide here to create a namespaced network. In the end, the script to create the network looked like this:

test_source_ip='5.5.5.5'
test_dest_ip='5.5.5.6'
ip netns add testns
ip netns exec testns ip link set dev lo up
ip link add veth0 type veth peer name veth1
ip link set veth1 netns testns
ip netns exec testns ifconfig veth1 ${test_source_ip}/24 up
ifconfig veth0 ${test_dest_ip}/24 up

testns is the name of the virtual namespaced network; you can call yours whatever you want.

The source IP and destination IP can be any arbitrary IP address, which means you can spoof arbitrary source IP addresses when running a scan, which is quite helpful. Be careful, however, not to mask any real IP addresses that the system might want to communicate with.

Finally, running your nmap scan is a matter of ensuring that it runs from within the namespaced network. You also need to scan the IP address of the paired virtual ethernet adapter in the root namespace (NOT the system's actual IP address):

ip netns exec testns nmap -sA -n ${test_dest_ip}

And you should see your scan run as if it actually came from 5.5.5.5.

[vagrant@2d33f851-838c-4 ~]$ sudo ip netns exec testns nmap -sA -n 5.5.5.6 

Starting Nmap 6.40 ( http://nmap.org ) at 2020-02-05 17:41 MST
Nmap scan report for 5.5.5.6
Host is up (0.000066s latency).
Not shown: 997 filtered ports
PORT     STATE      SERVICE
22/tcp   unfiltered ssh
1234/tcp unfiltered hotline
5678/tcp unfiltered rrac
MAC Address: FE:64:90:7E:51:81 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 5.13 seconds
[vagrant@2d33f851-838c-4 ~]$