On Sat, Feb 01, 2003 at 04:11:50PM -0800, k n wrote: > Hi, > > I'm using iptables on RedHat 8 with the rules listed > below. When scanned from outside the TCP port appear > as filtered; however, the UDP port is still open. > > $ip0 is my external IP address. > > Am I doing something wrong? that the TCP-port shows up as filtered is normal since you just DROP the SYN-packets. If you wouldn't have a firewall and there would not be daemon running the machine would send a tcp-reset packet and send it back to nmap. This is interpreted as "connection refused", meaning that there is not a server running on the tcp-port. That UDP stuff surprises me a bit; if you send a packet to a UDP port and no server is running the machine would generate an ICMP port-unreachable message which should have been interpreted by nmap. But since you drop all packets to 53/udp a ICMP-message was never generated and nmap couldn't have received one. I just tested on my machine (locally with loopback and nmap 2.54BETA22): Nonfiltered udp-ports show up as "closed" DROPed udp-ports show up as "open" Maybe nmap interprets it like that "as long as i don't get any errors i threat it like it would be open." And this sort of correct as well, since you don't have a "real connection" like in TCP - the application has to do everything on it's own. So that UDP-stuff doesn't surprise me anymore ;-) Don't DROP. Send real tcp-resets for unwanted TCP-connections and send real ICMP port-unreachable messages for unwanted UDP-connections and everything else. Just my 2c. HTH, Alex. -- "Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal." Instructions for use of this post: Insert tounge in cheek. Read as normal.
Attachment:
pgp00307.pgp
Description: PGP signature
