Nmap shows tcp port 21 open, but should not

[ccb056]

Hi guys,

Maybe you can answer this question.  I have my pfsense box setup as a typical NAT router with a few port forwards.  I was doing a scan on the box from the WAN side of the router with nmap and found that port 21 was open and running a ftp service.  I do not have any NAT forwards or firewall rules for port 21.  I do not have any packages installed on my pfsense box.  I am running pfsense 2.0x64

Any ideas?

this is the nmap command I ran:
nmap -p 1-65535 -T4 -A -v -v -Pn 97.95.37.241

PORT      STATE  SERVICE    VERSION

21/tcp    open  ftp?

|_ftp-bounce: no banner

[jimp]

That is probably the FTP proxy grabbing the connection.

You client will see it as open because it's talking to the proxy.

As evidenced by your output there, there was no banner, and no actual service ("ftp?").

Though you could only make that connection if the firewall rules allowed it. It wouldn't just randomly let that in unless it was told to.

[costasppc]

Here is mine:

PORT    STATE SERVICE    VERSION
21/tcp  open  tcpwrapped

Kostas

[jimp]

Bear in mind when you test FTP from a remote location, if you are behind a firewall with an enabled FTP proxy you will be seeing that proxy in your scan output, and not the FTP service on the target machine.

You can confirm that with packet captures.

[johnpoz]

I just checked my pfsense from outside

PING 24.13.xxx.xxx (24.13.xxx.xxx) 32(60) bytes of data.
40 bytes from 24.13.xxx.xxx: icmp_seq=1 ttl=48 time=112 ms
40 bytes from 24.13.xxx.xxx: icmp_seq=2 ttl=48 time=114 ms
40 bytes from 24.13.xxx.xxx: icmp_seq=3 ttl=48 time=113 ms
40 bytes from 24.13.xxx.xxx: icmp_seq=4 ttl=48 time=114 ms

Checked port 21 on Host/IP 24.13.xx.xx…
The checked port (21) is offline/unreachable
Reason: Connection timed out (110)
Portscan ran for 9.9956 seconds

Also checked ipv6

PING 2001:470:xxxx:b85::200(2001:470:xxxx:b85::200) 32 data bytes
40 bytes from 2001:470:xxxx:b85::200: icmp_seq=0 ttl=56 time=134 ms
40 bytes from 2001:470:xxxx:b85::200: icmp_seq=1 ttl=56 time=128 ms
40 bytes from 2001:470:xxxx:b85::200: icmp_seq=2 ttl=56 time=126 ms
40 bytes from 2001:470:xxxx:b85::200: icmp_seq=3 ttl=56 time=142 ms

So you see it answers pings -- but ftp is closed

Checked port 21 on Host/IP 2001:470:xxxx:b85::200...
The checked port (21) is offline/unreachable
Reason: Connection timed out (110)
Portscan ran for 9.9985 seconds

Where are you checking from exactly?  You can try the scanners at http://www.subnetonline.com/pages/network-tools.php

And as suggested I would check your logs/sniff at your pfsense box while doing the scan.

block Dec 12 10:58:36 WANIPV6 [2001:1af8:4200:b000:20c:29ff:fe6b:49d2]:58068 [2001:470:xxxx:b85::200]:21 TCP:S
block Dec 12 10:58:30 WANIPV6 [2001:1af8:4200:b000:20c:29ff:fe6b:49d2]:58068 [2001:470:xxxx:b85::200]:21 TCP:S
block Dec 12 10:58:27 WANIPV6 [2001:1af8:4200:b000:20c:29ff:fe6b:49d2]:58068 [2001:470:xxxx:b85::200]:21 TCP:S

block Dec 12 10:52:52 WAN 85.17.185.51:20962 24.13.xxx.xxx:21 TCP:S
block Dec 12 10:52:46 WAN 85.17.185.51:20962 24.13.xxx.xxx:21 TCP:S
block Dec 12 10:52:43 WAN 85.17.185.51:20962 24.13.xxx.xxx:21 TCP:S

[costasppc]

I am using the Hackertarget.com online NMAP scan http://hackertarget.com/nmap-scan/

Regards

Kostas

[johnpoz]

Ok just did a scan with them

HackerTarget.com Membership Status: Non-member

Starting Nmap 5.51 ( http://nmap.org ) at 2011-12-12 13:02 EST
Nmap scan report for c-24-13-xxxx.hsd1.il.comcast.net (24.13.xxx.xx)
Host is up (0.051s latency).
Not shown: 997 filtered ports
PORT     STATE SERVICE        VERSION
22/tcp   open  ssh            OpenSSH 5.8p1 Debian 7ubuntu1 (protocol 2.0)
443/tcp  open  https?
5001/tcp open  commplex-link?
Service Info: OS: Linux

So those are the ports I have open - yup, 443 is my openvpn, and 5001 is my slingbox, and sure ssh – does not show 21/ftp open on my pfsense box.  Which is correct, I don't have it open or forwarded to anywhere.

Seems to have missed my p2p port of 42312 both tcp and udp and my ntp port udp 123, since I have a box as a member of pool.ntp.org

[costasppc]

I am convinced  :)