We use zmap to port scan remote devices within our network. The devices have a "WAN" port which is basically where the public IP is configured. Then the other ports are on the natted/inside private network. Since we are scanning the public IP which sits on the "outside" interface, is it possible for the scan to pick up a port-forwarded service listening on an inside interface? For instance, I scan the outside interface for something listening on UDP port 67. If the remote user has port 67 forwarded to an internal DHCP server, should I expect my scan to pick that up as an "open" port, even though its technically not on the outside interface?
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.– Ron Maupin ♦Dec 21, 2020 at 18:19
Add a comment
|
1 Answer
Yes, you should see it as open, if the port on the WAN side is natted to the internal network and the internal server can route back out the nat device.
On a normal FW where nat is setup for internal traffic connection out through the FW the ports will not be open, only for the external device connected to.
-
So what would you suggest if one is not concerned with users that have a port legitimately open? I guess what I am trying to say is what good is it to scan your devices outside interface if its conceivable that an inside system could be the culprit? Basically we are only concerned with someone/something that has hacked the device itself and setup a rouge server that only uses the outside interface. Aug 15, 2016 at 20:35