Wierd nmap results on standard IPTABLES chain

[jonnevers]

Hello,

I've been creating some iptables rules and I wanted to test them, so i accessed an external host and

nmap'd my host... the results are a little confusing...


(The 1626 ports scanned but not shown below are in state: closed)
Port State Service
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
80/tcp open http
110/tcp open pop-3
136/tcp filtered profile
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
143/tcp filtered imap2
443/tcp open https
445/tcp filtered microsoft-ds
593/tcp filtered http-rpc-epmap
3306/tcp filtered mysql
4444/tcp filtered krb524
6346/tcp filtered gnutella
6699/tcp filtered napster
8888/tcp filtered sun-answerbook

Nmap run completed -- 1 IP address (1 host up) scanned in 16.868 seconds


the confusing part is
593/tcp filtered http-rpc-epmap

4444/tcp filtered krb524
6346/tcp filtered gnutella
6699/tcp filtered napster
8888/tcp filtered sun-answerbook

i'm not running those services, never have and none of my internal hosts have. nor have i ever explicitly blocked those ports using iptables.

are they standard blocks? or what?

thanks,
Jon

[sschlueter]

These ports might be filtered by your ISP (or any router along the way). Port 593 probably is blocked to protect systems against the blaster worm and port 4444 is probably blocked to prevent the blaster worm from spreading.

[starbecks]

I'm glad I found this answer. I was kinda freaked out when I nmap'd into my home pc and got this back

[fleed]

You could also do netstat -l and look for those ports... Or nmap from a computer on your external network that doesn't go through your ISP.

[starbecks]

Points for quickness (and helpfullness) fleed...

netstat was a good call, thanks. Before I posted, one of the first things I checked was to find out what services were running.

As for nmaping from the inside, I took out my laptop, hooked it into the network, and nmap'd the other local addresses. I got good (expected) results.

The only way to get outside my intranet yet remain inside the extranet is to plug directly into the cable modem. That may help but... I'd have to telnet into my router to see what MAC address my ISP thinks it is talking to... find that NIC.. reconfigure that machine.. I tend to believe sschlueter (read: I'm too lazy)

The only weirdness is when coming from the outside.. so I can deduce the ISP is 'helping us out' by filtering trouble ports. Weirdness makes me paranoid until I understand it... and it stops being weird... and my paranoia turns to apathy.

[fleed]

It sounds like a bit too much for me too. I'd just trust that's what's happening too.

What you could also try is nmapping a different ip on your ISP to see what you get. Make sure you do it from the same pc as before so you get similar results.