Suppose I have a setup as:

host_1 --- Firewall_1 --- Internet --- Firewall_2 --- host_2

I need to check which ports are open on host_2 from host_1 (which may be blocked by either firewalls)

Is there a tool that comes in two parts (one running on host_1 and other on host_2) that does this for me? It should be something like:

1 Listen to all ports on host_2
2 Try to connect to every port on host_2 from host_1
3 Give a report what ports are allowed.

5 Answers 5


nmap is the traditional port-scanner, and will do the job fine. You would install it on host1, and run it against host 2, eg with

host1% nmap -sT host2

I endorse comments by other users about not doing this on equipment unless you either own it yourself, or have written permission from the system owners to do it. Penetration tests and other forms of port-scanning without permission will not endear you to anyone.

  • I am developing an app that needs to work over firewalls, so I am doing this research.
    – Jus12
    Feb 9, 2011 at 18:26
  • 2
    Jus12, I'm not asking you to justify yourself, least of all to me. You need to make sure you've got clear permission when you do this, is all. As Randall Schwartz found out at Intel (google it), even the whitest of white hats can fall foul of people who don't understand that he's doing a good thing.
    – MadHatter
    Feb 9, 2011 at 21:36

If you have access to host_2 then run a port scanner there scanning itself. nmap http://nmap.org would do it.

If you don't have access to host_2 then you will only get there through both firewalls, and only the ports allowed by the firewalls on host_2 will be accessible. You cannot scan through the firewall, that is one of the reasons you have a firewall at all!


Any port scanner will do this for you, but you should know that that kind of activity is severely frowned upon if you don't own all of the systems involved or at the very least don't have a good understanding from all parties involved.


nmap is my preference to do this, here is an example I use

nmap -p 10-6000 -v -e eth0 remote-host -P0 -sT localhost

using -p you can limit the ports being scanned, without it will run for all.


Everyone is on the money with nmap. I would use the following.

From host1:

nmap -PN -sSU -p U:1-65535,T:1-65535 -vvv -n host2_IP -oN output_report.txt
  • -PN = don't ping the host
  • -sSU = this is a Syn and UDP scan (just the types of scans you want to do)
  • -p = the ports you want to try find open U:UDP port range,T:TCP port range
  • -vvv just be verbose and give me info
  • -n do not do a name query (speeds it up if you don't need it)
  • -oN output the results to a file

If the port comes back as "open" then it's obviously open. Same thing for closed. If it comes back as "filtered" that means there is a firewall in the way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.