0

I have a VPS with debian wheezy installed on it. A firewall is active on the it with all ports not allowed by default. The firewall can be managed through the web interface of the provider of the VPS and recently, I have opened a port through this web interface. No process is attached to this port actually.

As I have SSH access, I would like to know if there is a command or a way for me to get the list of the unblocked ports of my VPS from the terminal.

4
  • Do you want to check full iptables list? Or do you want to know if someone from outside can access your VPS?
    – Navern
    Aug 19, 2015 at 17:18
  • If the firewall can be managed through a web interface then that web interface should also provide a status display showing its current state and configuration. Aug 19, 2015 at 17:22
  • Yeah @TilmanSchmidt the web interface displays current state. But I just wanted to know whether I can see it from my terminal Aug 19, 2015 at 17:51
  • @Navern if full iptables list can tell me open ports, yes I do. Aug 19, 2015 at 17:52

2 Answers 2

0

It depends, mainly on how the firewall is blocking closed ports.

A remote portscan could be a method. A closed port, which isn't blocked by your firewall but which doesn't have an associated process actively listening and accepting connections might be determined that way.

The nmap manual has some background information on that.

0

It depends entirely on the nature of the firewall in question.

If it is a physically separate device then the only reliable way of detecting a port as "open" in the sense of "not blocked" is to actually send traffic to it from the outside and see whether it arrives at the inside. Everything else produces circumstantial evidence at best, as the firewall is free to answer to traffic on a blocked port in any way it sees fit. It may make the port appear as "open" in the sense of "serviced by a process", "closed" in the sense of "no process listening", or "filtered" in the sense of "not replying at all".

If it is actually implemented on the server itself via iptables then, given root access, you can read and analyze the current iptables configuration to distill the information from it which ports are passed through unmodified. You'll have to decide for yourself whether you'll include ports that are processed in some nontrivial way (such as NAT) in the "unblocked", "blocked", or another category.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .