How do I scan a firewall to find open outgoing ports?

Question

I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports.

I've done some research and found Firewalk but it hasn't been maintained in 10 years, and didn't seem to work for me when I tried it.

I did some googling and found some sites saying you can do this with nmap, but I couldn't get this working either.

Does anyone know of a better way than setting up a box outside the firewall listening on every port and trying to port scan it from the inside?

Answer 1

Say you have three subnets and a server on one of them, but want to see what rules are open to the other two. I run a nmap scan against the other two from the server. I typically use this line:

nmap -v -oA `hostname`_full-nmap-`/bin/date +%y%m%d` -P0 -sS -F -n --host_timeout 240000 --max_rtt_timeout 300 --initial_rtt_timeout 2000 --max_parallelism 250 192.168.123.0/24 192.168.234.0/24

You could apply a similar concept routing to the Internet as well, as nmap will identify what ports are filtered.

Answer 2

Will strobe do it? http://www.cerias.purdue.edu/about/history/coast/archive/data/categ50.html

I've had good results with namp.

Answer 3

Because you need something to reply on those ports your idea of having a machine on each side of the firewall is the best. Without that target machine the port may be open on the firewall itself but because it won't (shouldn't?) respond to traffic on that port you would be unaware of it. Is such a situation you would be unable to tell the difference between the port being closed with firewall simply dropping the packets or the port being open but nothing on the other end to respond.

Answer 4

Firebind.com provides this service.

It lets you test your outbound connectivity over an arbitrary range of UDP or TCP ports. Testing ranges larger than 100 ports requires a free account.