Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I have a setup as:

host_1 --- Firewall_1 --- Internet --- Firewall_2 --- host_2

I need to check which ports are open on host_2 from host_1 (which may be blocked by either firewalls)

Is there a tool that comes in two parts (one running on host_1 and other on host_2) that does this for me? It should be something like:

1 Listen to all ports on host_2
2 Try to connect to every port on host_2 from host_1
3 Give a report what ports are allowed.
share|improve this question
up vote 4 down vote accepted

nmap is the traditional port-scanner, and will do the job fine. You would install it on host1, and run it against host 2, eg with

host1% nmap -sT host2

I endorse comments by other users about not doing this on equipment unless you either own it yourself, or have written permission from the system owners to do it. Penetration tests and other forms of port-scanning without permission will not endear you to anyone.

share|improve this answer
I am developing an app that needs to work over firewalls, so I am doing this research. – Jus12 Feb 9 '11 at 18:26
Jus12, I'm not asking you to justify yourself, least of all to me. You need to make sure you've got clear permission when you do this, is all. As Randall Schwartz found out at Intel (google it), even the whitest of white hats can fall foul of people who don't understand that he's doing a good thing. – MadHatter Feb 9 '11 at 21:36

If you have access to host_2 then run a port scanner there scanning itself. nmap would do it.

If you don't have access to host_2 then you will only get there through both firewalls, and only the ports allowed by the firewalls on host_2 will be accessible. You cannot scan through the firewall, that is one of the reasons you have a firewall at all!

share|improve this answer

Any port scanner will do this for you, but you should know that that kind of activity is severely frowned upon if you don't own all of the systems involved or at the very least don't have a good understanding from all parties involved.

share|improve this answer

nmap is my preference to do this, here is an example I use

nmap -p 10-6000 -v -e eth0 remote-host -P0 -sT localhost

using -p you can limit the ports being scanned, without it will run for all.

share|improve this answer

Everyone is on the money with nmap. I would use the following.

From host1:

nmap -PN -sSU -p U:1-65535,T:1-65535 -vvv -n host2_IP -oN output_report.txt
  • -PN = don't ping the host
  • -sSU = this is a Syn and UDP scan (just the types of scans you want to do)
  • -p = the ports you want to try find open U:UDP port range,T:TCP port range
  • -vvv just be verbose and give me info
  • -n do not do a name query (speeds it up if you don't need it)
  • -oN output the results to a file

If the port comes back as "open" then it's obviously open. Same thing for closed. If it comes back as "filtered" that means there is a firewall in the way.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.