1

I configured a new Ubuntu Installation and set up the firewall. All incoming was denied and all outgoing was denied as well(with exception for port 8080, as I am behind a proxy). I then tried an online port scan and found that my ssh port(22) was open. I double checked but the problem remained. I specifically denied port 22 in the firewall, but the port is still shown as open(all other ports are closed). What is the reason behind this?

Output of netstat -tlpn is

tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      -               
tcp6       0      0 ::1:631                 :::*                    LISTEN      -      
5
  • Please add the output of netstat -tlpn to your question..
    – heemayl
    Aug 8, 2015 at 20:30
  • I wouldn't trust online scanners much. Use nmap Aug 8, 2015 at 20:34
  • 1
    As you can see port 22 is not in listening state i.e. open..
    – heemayl
    Aug 8, 2015 at 20:35
  • If you are using an online scanner you are scanning your router.
    – Panther
    Aug 8, 2015 at 20:36
  • Does that mean that my firewall(configured locally) isn't being scanned at all? The "router's"(the proxy servers, I suppose in this case, run by the college) capabilities are tested by the scans? That does make sense though, since I am getting the same results with firewall disabled as well. Aug 8, 2015 at 20:40

1 Answer 1

1

As the netstat -tlpn output indicates you don't have port 22 is in LISTEN state that is the port is closed.

As for the Online scan results, this should be the results from scanning the public IP interface of your router (could be the proxy in your case).

6
  • In the netstat output, one of the items displayed is "127.0.0.1:631 ". The first part 127.0.0.1 is the loopback address; what does the second part(631) mean? Is it that port 631 is listening for traffic? Aug 8, 2015 at 20:58
  • @MayankSingh Yes..its the IPP (Internet Printing Protocol)..btw don't disable port 53 by any means, its the DNS port..
    – heemayl
    Aug 8, 2015 at 20:59
  • On my home internet connection(mobile broadband directly connected the the internet), I had to manually allow all the required ports for outbound connection(80,443,53 at the least) so as to get online. Whilst, in college, while I am behind proxy, I only allowed 8080 to communicate online(which is the proxy port behind http). How then is port 53 automatically listening when it isn't allowed by the firewall?Shouldn't it be like manually allowed in the firewall before it can be in listen mode? Aug 8, 2015 at 21:05
  • @MayankSingh Hold on..you have port 53 is in listening state..whats the output of sudo netstat -tlpn | grep -Po '^tcp\s.*:53\s+.*LISTEN\s+\K[^\s]+' ?
    – heemayl
    Aug 8, 2015 at 21:17
  • The output comes out to "3341/dnsmasq" though I don't understand what it means. Aug 8, 2015 at 21:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .