>Phill wrote:
>> I know this isn't RHEL support, but I thought I'd ask this question anyways, see if >you gurus know what might be going on. I have a rhel 5 web/ftp server. I'm using >iptables to filter all ports except 21 and 80. Yet if I do an nmap of the server, this >is the output I get.
>> -------------------------------
>> PORT STATE SERVICE
>> 21/tcp open ftp
>> 80/tcp open http
>> 1720/tcp open H.323/Q.931
>> 6000/tcp closed X11
>> 6001/tcp closed X11:1
>> 6002/tcp closed X11:2
>> 6003/tcp closed X11:3
>> 6004/tcp closed X11:4
>> 6005/tcp closed X11:5
>> 6006/tcp closed X11:6
>> 6007/tcp closed X11:7
>> 6008/tcp closed X11:8
>> 6009/tcp closed X11:9
>> 6017/tcp closed xmail-ctrl
>> 6050/tcp closed arcserve
>> ---------------------------------
>>
>> Note the listening port 1720, netstat shows no service listening
>> Should be irrelevant since the only traffic I'm accepting is port 21 and port 80, >and related established. Shouldn't this output just show me port 21 and port 80 open >and nothing else?
>>
>How is your firewall configured? It appears, from the output, that the
>firewall (I don't know if you're scanning from inside your network or
>outside, so it could be iptables on the server or an external firewall)
>is configured to allow those ports, although the server appears to not
>be answering on those ports.
>
>Making sure that those ports are closed on the firewall, as well, nmap
>won't actually be able to scan them.
>From /etc/sysconfig/iptables-config
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp ip_nat_ftp"
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
372 394K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2 108 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:21
3528 192K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80
176K 19M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
4228 1387K DROP all -- * * 0.0.0.0/0 255.255.255.255
10218 1177K DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:137:139
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:67:68
3536 209K LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `Dropped INPUT '
3536 209K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `Dropped FORWARD '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
372 394K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
106K 291M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `Dropped OUTPUT '
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
This machine is on a separate network. I'm connected to this network via ipsec tunnel. I wondered if nmapping through that router might affect the output. You are correct. The network firewall blocks all ports except 21 and 80 from the outside world. So no one outside the network can scan these ports. However, I shouldn't be able to scan them either according to my knowledge of netfilter and iptables rules. I still don't understand what service would be listening on port 1720.
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
