1

I have Cisco 2911 router just booted with factory settings and no ACLs or NAT configured. All I did is turned on the interfaces and assigned IPs.
I am trying to scan for open ports with Nmap, but the output shows that all ports are closed.
So I used

nmap 192.168.2.1

that returns

All 1000 scanned ports on 192.168.2.1 are closed

Scanning port 80 alone also shows that it is closed

nmap -p 80 192.168.2.1
PORT STATE SERVICE
80/tcp closed http

And if I try this

nmap -sT -p 80 -Pn 192.168.2.1

it returns

Host is up.
PORT STATE SERVICE
80/tcp filtered http

I also have webserver running behind the router and I can access it through browser, so obviously at least port 80 is not closed. But it is supposed to be all open, since by default Cisco router has it all ports open. Do I get some fundamental concept wrong or what can be the problem?

2

You are nmapping the cisco router, so you are checking the open cisco ports, not the open webserver ports behind it.

If you nmap the webserver you'll find port 80 open.

  • Router should listen on port 80 in order to send it further to the server, no? – ScienceSamovar Nov 16 '15 at 15:20
  • @ScienceSamovar: That's the clue. You are scanning the router. It should listen on port 80 just in case of being a webserver himself. When you connect to the webserver behind, the router routes the packets to the webserver. Hope it helps. – Ra_ Nov 16 '15 at 15:33
0

By default nmap scans only a subset of all ports, as from your command, notice the 1000:

All 1000 scanned ports on 192.168.2.1 are closed

At this point i would use this parameters (notice the -p-, that means all ports)

nmap -vvv -A -sT -p- 192.168.2.1
  • But why all TCP and UDP ports are closed, when there is no ACL denying them? – ScienceSamovar Nov 16 '15 at 15:22
  • If you're scanning the router IP you can find open ports only on that IP, not the servers behind. For that to work you should have some ports forwarded to the router's ip, as for example. if your webserver is at 192.168.2.2 than you can tell the router that connections that come for 192.168.2.1 (router's IP) should be forwarded at 192.168.2.2 port 80 and vice versa. – Fredi Nov 16 '15 at 15:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.