1

I am trying to block all systems ports accept 4444 in Kali Linux. I added 4444 in my iptables and restarted iptables service.

now nmap hostname -p 4444 is displaying it as open port but when I am using my system IP 192.168.1.3 then its showing 4444 port as closed

    $ nmap linux -p 4444
    Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-24 15:42 +0430
    sendto in send_ip_packet_sd: sendto(4, packet, 44, 0, 127.0.1.1, 16) => Operation not permitted
    Offending packet: TCP 127.0.0.1:50026 > 127.0.1.1:4444 S ttl=44 id=30247 iplen=44  seq=3026860575 win=1024 <mss 1460>
    sendto in send_ip_packet_sd: sendto(4, packet, 44, 0, 127.0.1.1, 16) => Operation not permitted
    Offending packet: TCP 127.0.0.1:50027 > 127.0.1.1:4444 S ttl=53 id=24606 iplen=44  seq=3026926110 win=1024 <mss 1460>
    Nmap scan report for linux (127.0.1.1)
    Host is up.
    rDNS record for 127.0.1.1: Linux.domain.linux

    PORT     STATE    SERVICE
    4444/tcp filtered krb524

    Nmap done: 1 IP address (1 host up) scanned in 2.11 seconds


    $ nmap 192.168.1.3 -p 4444
    Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-24 15:43 +0430
    Nmap scan report for 192.168.1.3
    Host is up (0.000022s latency).

    PORT     STATE  SERVICE
    4444/tcp closed krb524

    Nmap done: 1 IP address (1 host up) scanned in 13.22 seconds


    $ hostname
    Linux

    $ ifconfig
    eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
            ether ec:f4:bb:2f:a2:d9  txqueuelen 1000  (Ethernet)
            RX packets 0  bytes 0 (0.0 B)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 0  bytes 0 (0.0 B)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
            device interrupt 20  memory 0xf7e00000-f7e20000  

    lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
            inet 127.0.0.1  netmask 255.0.0.0
            loop  txqueuelen 1000  (Local Loopback)
            RX packets 63438  bytes 78026474 (74.4 MiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 63438  bytes 78026474 (74.4 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
            inet 10.115.210.220  netmask 255.255.254.0  destination 10.115.210.220
            unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
            RX packets 182  bytes 69832 (68.1 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 234  bytes 40743 (39.7 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.1.3  netmask 255.255.255.0  broadcast 192.168.1.255
            inet6 fe80::8286:f2ff:fe6e:59e2  prefixlen 64  scopeid 0x20<link>
            ether 80:86:f2:6e:59:e2  txqueuelen 1000  (Ethernet)
            RX packets 387176  bytes 530891372 (506.2 MiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 357454  bytes 58810528 (56.0 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
1

Your hostname linux does not map to your external ip-address 192.168.1.3, but to the loopback interface as shown from: Nmap scan report for linux (127.0.1.1), which would explain a different result compared to scanning the external interface.

You don't display your firewall configuration but typically firewall rules are different for the loopback interface (typical rulesets include a iptables -I INPUT -i lo -j ACCEPT to accept all traffic internal to a system)

4
  • Thanks. Now its working on both hostname as well as ip but don't know what I did it showing same result but port become closed even its open in iptables Chain ufw-user-output (1 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:4444 ACCEPT udp -- anywhere anywhere udp dpt:4444
    – Raakh
    May 24 '18 at 14:16
  • $ iptables -t nat -L -v Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
    – Raakh
    May 24 '18 at 15:38
  • I marked your post as answered but still I have problem somewhere that both ip + hostname showing port 4444 closed
    – Raakh
    May 24 '18 at 15:40
  • 1
    A port will be closed when it is blocked by a firewall, but also when nothing is listening on a port. Check the latter with for instance sudo netstat -tnlp | grep :4444 or sudo ss -tnlp | grep :4444
    – HBruijn
    May 24 '18 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.