IP Tables shows port open, nmap shows port closed

tkinsella · 09-09-2014, 12:25 PM

On my machine I have the following in iptables :

Code:

[root@new-dev conf.modules.d]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 state NEW,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8000 state NEW,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 state NEW,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:5000 state NEW,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

But nmap is showing :

Code:

[ta@tom-ws01 ~]$ nmap -sT new-dev

Starting Nmap 5.51 ( http://nmap.org ) at 2014-09-09 10:18 PDT
Nmap scan report for new-dev (10.0.38.20)
Host is up (0.0032s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
111/tcp open  rpcbind

Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds
[ta@tom-ws01 ~]$ nmap -sT new-dev -p 8000

Starting Nmap 5.51 ( http://nmap.org ) at 2014-09-09 10:21 PDT
Nmap scan report for new-dev (10.0.38.20)
Host is up (0.0015s latency).
PORT     STATE  SERVICE
8000/tcp closed http-alt

Nmap done: 1 IP address (1 host up) scanned in 0.14 seconds

Not sure what is going on? Thoughts?

Thanks!

tkinsella · 09-09-2014, 03:46 PM

UPDATE:

I've disabled IP Tables.

netstat -tulpn shows the port is LISTEN

nmap shows port is closed still

es0teric · 09-09-2014, 08:09 PM

Can you telnet to whatever service is listening on port 8000?

yzT! · 09-12-2014, 02:36 AM

maybe is it a local service? do a nmap -sT localhost -p 8000 to see whether it reports it as open

cepheus11 · 09-12-2014, 02:43 AM

Your iptables configuration does not block anything. To block any incoming packets, you need INPUT-rules with targets DROP/REJECT or (even better) an INPUT policy DROP. From iptables' view, everything is open.

For a port to be really open, you need a program listening to that port. As yzT! suggested, maybe your program does only listen to the loopback interface. What is the exact output of the netstat command:

Code:

netstat -tlpn