Nmap scan on WAN reveals captive portal

[Sifter]

My captive portal is running on OPT1, which has a wireless router plugged into it.  The interface is not bridged with any other interface.  When I perform an nmap scan of my WAN, port 8000 shows up.  Is this right?

Running a full HD ver. RELENG_1_SNAPSHOT_03-19-2006 built on Sat Mar 18 01:47:08 UTC 2006

[sullrich]

It should not be happening.

PF rules take priority over ipfw which the captive portal uses.

I would double check your wan rules.

[Sifter]

Starting Nmap 4.01 ( http://www.insecure.org/nmap ) at 2006-03-23 22:43 Pacific
Standard Time
Warning:  OS detection will be MUCH less reliable because we did not find at lea
st 1 open and 1 closed TCP port
Insufficient responses for TCP sequencing (0), OS detection may be less accurate

Insufficient responses for TCP sequencing (0), OS detection may be less accurate

Interesting ports on noip.or.comcast.net (67.171.1X.X):
(The 1663 ports scanned but not shown below are in state: filtered)
PORT    STATE SERVICE
21/tcp  open  ftp
53/tcp  open  domain
80/tcp  open  http
81/tcp  open  hosts2-ns
443/tcp  open  https
444/tcp  open  snpp
1723/tcp open  pptp
3000/tcp open  ppp
8000/tcp open  http-alt
Device type: general purpose
Running (JUST GUESSING) : OpenBSD 3.X (93%), FreeBSD 5.X|4.x (92%), Linux 2.6.X
(87%), Microsoft Windows NT/2K/XP|2003/.NET (86%), IBM AIX 4.X (85%)
Aggressive OS guesses: OpenBSD 3.6 (93%), OpenBSD 3.7 (93%), FreeBSD 5.3 (92%),
DragonFly 1.1-Stable (FreeBSD-4 fork) (87%), Linux 2.6.10 (87%), Linux 2.6.7 (87
%), OpenBSD 3.3 x86 with pf "scrub in all" (87%), OpenBSD 3.5 or 3.6 (87%), Free
BSD 5.2 - 5.4 (86%), FreeBSD 5.4 (86%)
No exact OS matches for host (test conditions non-ideal).

Nmap finished: 1 IP address (1 host up) scanned in 29.142 seconds

I have ports 21, 80, 81, 443, and 444 forwarded on the WAN.  Interesting that the others show up.

[sullrich]

Well it appears that either your filter is not loaded at all or you have a pass any rule on wan.

[Sifter]

[sullrich]

Never heard of a source of 12.18:

Is this something new that I should be aware of?

[Sifter]

I photoshopped half that IP address out.  12.18.X.X

[sullrich]

Run a pfctl -f /tmp/rules.debug and see if you get an error.

[Sifter]

pfctl -f /tmp/rules.debug

returns no errors.

[sullrich]

Just nmapped our captive portal here… And its not doing this.

nmap -P0 10.0.0.80

Starting nmap 3.93 ( http://www.insecure.org/nmap/ ) at 2006-03-24 12:49 EST
All 1668 scanned ports on 10.0.0.80 are: filtered
MAC Address: 00:00:24:C1:F7:71 (Connect AS)

Nmap finished: 1 IP address (1 host up) scanned in 36.169 seconds