I am trying to understand the results I am getting when scanning ports on a machine that has an active built-in Windows Firewall. My test environment has two Windows 7 machines running in Hyper-V VMs connected directly with an internal virtual switch and in the same subnet with no other firewalls between them.
Machine A - Windows Firewall turned off and running Nmap 7.60
Machine B - Machine being scanned
When Windows Firewall is turned off on Machine B, all ports are showing as either open or closed - EXPECTED.
When Windows Firewall is turned on on Machine B with default rules, some ports are showing as opened (EXPECTED) and the rest are showing as Filtered.
When I create an inbound rule to allow connections on a specific port that doesn't have a listener, I would expect that port to be scanned as closed, however it is still showing as Filtered with the reason No Response.
Can someone explain why is there no response when scanning a port for which there is an active inbound rule to allow connections and no deny rule? I am using SYN scan.