Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I come from a Unix background but got the task of configuring a Windows firewall on a public facing server.

I find awkward that any nmap scan I perform against the public IP reports all TCP ports from 1 to 65389 as open regardless of the Windows default rule of not allowing Inbound connections that do not match a rule.

I even got locked out of remote desktop after selecting "Block All Connections" on the Inbound rule of one of the profiles but still nmap shows:

3389/tcp open ms-term-serv

How is this explained

share|improve this question

1 Answer 1

You're scanning the public ip address, which is assigned to the router/firewall, some ports are NAT'ed/forwarded to the server, the rest are not. The server isn't responding to your nmap scan, the router/firewall is, except for those ports that are NAT'ed/forwarded to the server, which will be reported as open, as they should be.

That's why it appears that all ports are open on the server. you need to look at the router/firewall configuration to determine why IT is reporting those ports as open (except for those ports that are NAT'ed/forwarded to the server).

share|improve this answer
    
+1... didn't think of that >< –  Ryan Ries Mar 9 '13 at 15:54
    
But the server has a static public IP assigned to the interface. Do you mean a router/firewall entity within Windows server? –  manthis Mar 10 '13 at 16:23
    
No, I mean the router/firewall in front of your server. The server should only answer for ports that are NAT'ed/forwarded to it and the router/firewall is answering for everything else. As a test, shut down the server and run the scan again. If you get the same results then that will confirm my assesment. –  joeqwerty Mar 10 '13 at 16:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.