I am using Ubuntu virtual host to run a tomcat based application that uses the ports 8080, 8009, and 8000. The network admin has already opened the ports and when I run nmap on localhost it shows that they are opened.

$ nmap localhost

Starting Nmap 7.60 ( https://nmap.org ) at 2020-02-10 12:46 UTC
Nmap scan report for localhost (
Host is up (0.00023s latency).
Not shown: 995 closed ports
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql
8009/tcp open  ajp13
8080/tcp open  http-proxy

However, running nmap from my machine, using the IP address shows me they are filtered.

$ nmap 120.xxx.xxx.xxx -p 8080

Starting Nmap 7.60 ( https://nmap.org ) at 2020-02-12 10:36 EAT
Nmap scan report for
Host is up (0.17s latency).

8080/tcp filtered http-proxy

Nmap done: 1 IP address (1 host up) scanned in 2.39 seconds

I don't have access to the azure interface, and there is no firewall enabled on the Ubuntu VM.

What could be filtering the request? What can I do?

  • Welcome to the site. You stated that your application uses ports 8000, 8009 and 8080, and that your admin has opened them, but I don't see port 8000 in your first nmap output. Could you comment on that point?
    – AdminBee
    Feb 12, 2020 at 8:26
  • Hi @AdminBee, thanks for the welcome. I think he was just trying something the moment I tried that command, I just had a chat with him and he will open it back.
    – altsyset
    Feb 12, 2020 at 8:35

1 Answer 1


Your Tomcat machine has (at least) 2 IPs (if network is up): (localhost) and the the one configured for the network that machine is on.

Of course, you can have more IPs on the same or different networks and you can config your Tomcat to listen on specific ones. Check your Tomcat config to make sure it is not only listening on since that may avoid access from the outside world.

Another test you can try is nmaping from your Tomcat machine to itself (not to the localhost address but the other one). If I am not mistaken when you ask to that IP the system will not send the packets to the outside world, it identifies that address as his own and sends the packets to itself. That way you can confirm your service is running on the correct IP and that the problem is inside/outside your box.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .