I'm looking for a tool that I can use within a firewalled network to scan the firewall to find open outgoing ports.

I've done some research and found Firewalk but it hasn't been maintained in 10 years, and didn't seem to work for me when I tried it.

I did some googling and found some sites saying you can do this with nmap, but I couldn't get this working either.

Does anyone know of a better way than setting up a box outside the firewall listening on every port and trying to port scan it from the inside?


Say you have three subnets and a server on one of them, but want to see what rules are open to the other two. I run a nmap scan against the other two from the server. I typically use this line:

nmap -v -oA `hostname`_full-nmap-`/bin/date +%y%m%d` -P0 -sS -F -n --host_timeout 240000 --max_rtt_timeout 300 --initial_rtt_timeout 2000 --max_parallelism 250

You could apply a similar concept routing to the Internet as well, as nmap will identify what ports are filtered.

  • Thanks for this; fyi nmap syntax has been updated for seconds, and P0 is deprecated; updated command: nmap -v -oA `hostname`_full-nmap-`/bin/date +%y%m%d` -Pn -sS -F -n --host_timeout 240 --max_rtt_timeout 3 --initial_rtt_timeout 2 --max_parallelism 250 <IPADDRESS>
    – jhaagsma
    May 3 '18 at 22:28

Here is what I did:

Set up one machine in the network under test, and one elsewhere on the Internet (on the other side of the firewall). You should be fine using windows or linux (I used CentOS). I had a public IP but I guess it would work with a 1:1 NAT.

On the internet machine, I ran a command which would open every port on my computer with nc. I did

for i in `seq 1 65000`; do nc -l $i &; sleep 1; done

The sleep is there to prevent it from spawning an excessive number of netcat processes at once. It went fine but took 65000 seconds (overnight).

On the tested network, I simply run

nmap -p- -PN <IP>

and wait for the results.

  • Welcome to serverfault! I've edited your answer to make it fit the style of other answers more closely; feel free to click edit yourself to see the markdown. Note that the grave character (`) is used to denote code sections, so using it as an apostrophe (') confuses the markdown engine :) May 23 '13 at 21:36

Firebind.com provides this service.

It lets you test your outbound connectivity over an arbitrary range of UDP or TCP ports. Testing ranges larger than 100 ports requires a free account.

  • 5
    Do you work for them?
    – jscott
    May 1 '12 at 18:16

Because you need something to reply on those ports your idea of having a machine on each side of the firewall is the best. Without that target machine the port may be open on the firewall itself but because it won't (shouldn't?) respond to traffic on that port you would be unaware of it. Is such a situation you would be unable to tell the difference between the port being closed with firewall simply dropping the packets or the port being open but nothing on the other end to respond.


Will strobe do it? http://www.cerias.purdue.edu/about/history/coast/archive/data/categ50.html

I've had good results with nmap.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.