Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an IPtables firewall set up on a single system. I'm trying to nmap it with the following command:

sudo nmap -Pn -A (IP addr)

I expect everything incoming to be filtered except for ports 22 and 80. However, all ports are being marked as filtered. When I flush the FW, 22 and 80 are marked as open and listening.

Chain INPUT (policy DROP 14 packets, 616 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
    2    88 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 
    2    88 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http 
   15  1496 ACCEPT     udp  --  any    any     anywhere             anywhere            udp spt:domain 
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:domain 
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-reply 
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request 
  722  359K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:http state ESTABLISHED 
  722  444K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:https state ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:domain state ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:ftp state ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:rsync state ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:smtp state ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:submission state ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:ssh state ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp spt:nicname state ESTABLISHED 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 17 packets, 940 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    lo      anywhere             anywhere            
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            udp spt:domain 
   15  1022 ACCEPT     udp  --  any    any     anywhere             anywhere            udp dpt:domain 
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-request 
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp echo-reply 
  876  245K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http state NEW,ESTABLISHED 
  843  127K ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:domain state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ftp state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:rsync state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:smtp state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:submission state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:nicname state NEW,ESTABLISHED 

Does anybody see the problem in my FW?

share|improve this question
    
You need to use the -v option to iptables -L to see the complete firewall rules. –  Michael Hampton Feb 17 at 19:22

1 Answer 1

Another way to test:

telnet <ipaddr> <port>
share|improve this answer
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. –  coincoin Feb 19 at 12:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.