I'm trying to audit firewall rules on a host. This is typically pretty straightforward to do with nmap or a similar scanning tool. The problem is that I can only run the audit on the host itself. Normally, if you run a port scan with nmap against the current host, nmap will use the loopback interface. This is a problem because the firewalls on the hosts that I care about allow all traffic on the loopback interface:
[my-host ~][I]% sudo iptables -vL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
[...snip...]
2364K 123M ACCEPT all -- lo any anywhere anywhere
[...snip...]
And consequently, when I scan the host, all ports appear to be allowed by the firewall:
[my-host ~][I]% sudo nmap -sA my-host
Starting Nmap 6.40 ( http://nmap.org ) at 2020-01-28 13:53 MST
Nmap scan report for my-host (172.20.48.30)
Host is up (0.000015s latency).
rDNS record for 172.20.48.30: my-host
All 1000 scanned ports on my-host (172.20.48.30) are unfiltered
Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds
So I tried specifying the interface to use, hoping to force the scan to route traffic through the host's normal network interface. But nmap can't find any open ports:
[my-host ~][I]% sudo nmap -sA my-host -e ens192 -Pn
Starting Nmap 6.40 ( http://nmap.org ) at 2020-01-28 13:54 MST
Nmap done: 1 IP address (0 hosts up) scanned in 0.44 seconds
However, I know that, in its firewall, the host allows at least port 22 from any other host on the same network. When I scan it from another host on the same network, that is what I see:
[my-other-host ~][I]% sudo nmap -sA my-host -Pn
Starting Nmap 6.40 ( http://nmap.org ) at 2020-01-28 13:55 MST
Nmap scan report for my-host (172.20.48.30)
Host is up (0.00021s latency).
rDNS record for 172.20.48.30: my-host
Not shown: 999 filtered ports
PORT STATE SERVICE
22/tcp unfiltered ssh
MAC Address: 00:50:56:A0:34:4D (VMware)
Nmap done: 1 IP address (1 host up) scanned in 4.51 seconds
So why can I not see these results when scanning my-host from itself? Is this due to the router configuration (which unfortunately I don't have access to), or am I making a mistake somewhere?