Nmap shows tcp port 21 open, but should not



  • Hi guys,

    Maybe you can answer this question.  I have my pfsense box setup as a typical NAT router with a few port forwards.  I was doing a scan on the box from the WAN side of the router with nmap and found that port 21 was open and running a ftp service.  I do not have any NAT forwards or firewall rules for port 21.  I do not have any packages installed on my pfsense box.  I am running pfsense 2.0x64

    Any ideas?

    this is the nmap command I ran:
    nmap -p 1-65535 -T4 -A -v -v -Pn 97.95.37.241

    PORT      STATE  SERVICE    VERSION

    21/tcp    open  ftp?

    |_ftp-bounce: no banner


  • Rebel Alliance Developer Netgate

    That is probably the FTP proxy grabbing the connection.

    You client will see it as open because it's talking to the proxy.

    As evidenced by your output there, there was no banner, and no actual service ("ftp?").

    Though you could only make that connection if the firewall rules allowed it. It wouldn't just randomly let that in unless it was told to.



  • Here is mine:

    PORT    STATE SERVICE    VERSION
    21/tcp  open  tcpwrapped

    Kostas


  • Rebel Alliance Developer Netgate

    Bear in mind when you test FTP from a remote location, if you are behind a firewall with an enabled FTP proxy you will be seeing that proxy in your scan output, and not the FTP service on the target machine.

    You can confirm that with packet captures.


  • LAYER 8 Global Moderator

    I just checked my pfsense from outside

    PING 24.13.xxx.xxx (24.13.xxx.xxx) 32(60) bytes of data.
    40 bytes from 24.13.xxx.xxx: icmp_seq=1 ttl=48 time=112 ms
    40 bytes from 24.13.xxx.xxx: icmp_seq=2 ttl=48 time=114 ms
    40 bytes from 24.13.xxx.xxx: icmp_seq=3 ttl=48 time=113 ms
    40 bytes from 24.13.xxx.xxx: icmp_seq=4 ttl=48 time=114 ms

    Checked port 21 on Host/IP 24.13.xx.xx…
    The checked port (21) is offline/unreachable
    Reason: Connection timed out (110)
    Portscan ran for 9.9956 seconds

    Also checked ipv6

    PING 2001:470:xxxx:b85::200(2001:470:xxxx:b85::200) 32 data bytes
    40 bytes from 2001:470:xxxx:b85::200: icmp_seq=0 ttl=56 time=134 ms
    40 bytes from 2001:470:xxxx:b85::200: icmp_seq=1 ttl=56 time=128 ms
    40 bytes from 2001:470:xxxx:b85::200: icmp_seq=2 ttl=56 time=126 ms
    40 bytes from 2001:470:xxxx:b85::200: icmp_seq=3 ttl=56 time=142 ms

    So you see it answers pings -- but ftp is closed

    Checked port 21 on Host/IP 2001:470:xxxx:b85::200...
    The checked port (21) is offline/unreachable
    Reason: Connection timed out (110)
    Portscan ran for 9.9985 seconds

    Where are you checking from exactly?  You can try the scanners at http://www.subnetonline.com/pages/network-tools.php

    And as suggested I would check your logs/sniff at your pfsense box while doing the scan.

    block Dec 12 10:58:36 WANIPV6 [2001:1af8:4200:b000:20c:29ff:fe6b:49d2]:58068 [2001:470:xxxx:b85::200]:21 TCP:S
    block Dec 12 10:58:30 WANIPV6 [2001:1af8:4200:b000:20c:29ff:fe6b:49d2]:58068 [2001:470:xxxx:b85::200]:21 TCP:S
    block Dec 12 10:58:27 WANIPV6 [2001:1af8:4200:b000:20c:29ff:fe6b:49d2]:58068 [2001:470:xxxx:b85::200]:21 TCP:S

    block Dec 12 10:52:52 WAN 85.17.185.51:20962 24.13.xxx.xxx:21 TCP:S
    block Dec 12 10:52:46 WAN 85.17.185.51:20962 24.13.xxx.xxx:21 TCP:S
    block Dec 12 10:52:43 WAN 85.17.185.51:20962 24.13.xxx.xxx:21 TCP:S



  • I am using the Hackertarget.com online NMAP scan http://hackertarget.com/nmap-scan/

    Regards

    Kostas


  • LAYER 8 Global Moderator

    Ok just did a scan with them

    HackerTarget.com Membership Status: Non-member

    Starting Nmap 5.51 ( http://nmap.org ) at 2011-12-12 13:02 EST
    Nmap scan report for c-24-13-xxxx.hsd1.il.comcast.net (24.13.xxx.xx)
    Host is up (0.051s latency).
    Not shown: 997 filtered ports
    PORT     STATE SERVICE        VERSION
    22/tcp   open  ssh            OpenSSH 5.8p1 Debian 7ubuntu1 (protocol 2.0)
    443/tcp  open  https?
    5001/tcp open  commplex-link?
    Service Info: OS: Linux

    So those are the ports I have open - yup, 443 is my openvpn, and 5001 is my slingbox, and sure ssh – does not show 21/ftp open on my pfsense box.  Which is correct, I don't have it open or forwarded to anywhere.

    Seems to have missed my p2p port of 42312 both tcp and udp and my ntp port udp 123, since I have a box as a member of pool.ntp.org



  • I am convinced  :)


Log in to reply