0

I'm fiddling around in my lab today and attempting to learn more about port-forwarding. I've noticed that when I set up port-forwarding for a given port and run a port scan from outside the network, it doesn't list those ports as being open. Is this by design? Will a port scan only list a port as open if that port connects to a reachable service on a reachable host? Does a closed mean blocked (filtered)? Or does closed just essentially mean no service availability (nothing is listening)?


Sorry. Didn't realize it was equipment specific. I have a Ubiquiti Unifi USG Pro 4 configured with the following port-forwarding:

auto-firewall disable
 hairpin-nat enable
 lan-interface eth1
 rule 3001 {
     description "SCW HTTP"
     forward-to {
         address 10.15.72.245
     }
     original-port 81
     protocol tcp_udp
 }
 rule 3002 {
     description "SCW RTSP"
     forward-to {
         address 10.15.72.245
     }
     original-port 554
     protocol tcp_udp
 }
 rule 3003 {
     description "SCW Server"
     forward-to {
         address 10.15.72.245
     }
     original-port 8000
     protocol tcp_udp
 }
 rule 3004 {
     description "Lab Domain L2TP/IPSec VPN - 1"
     forward-to {
         address 10.15.72.34
     }
     original-port 1701
     protocol udp
 }
 rule 3005 {
     description "Lab Domain L2TP/IPSec VPN - 2"
     forward-to {
         address 10.15.72.34
     }
     original-port 500
     protocol udp
 }
 rule 3006 {
     description "Lab Domain L2TP/IPSec VPN - 3"
     forward-to {
         address 10.15.72.34
     }
     original-port 4500
     protocol udp
 }
 wan-interface eth0

I got curious because all of my SCW (Security Cameras) ports show as open on my scan but they also point to an active service on the network. I am in the process of trying to figure out how to setup an L2TP/IPSec VPN to my Windows Server so I created port forwards for UDP ports 500, 1701, and 4500 per the Ubiquiti documentation. Whenever I run an external port scan, however, those ports still show as closed. I've been unsuccessful in my VPN connection attempts up until now, although my tcpdump is now capturing some traffic when I try to connect via the Windows 10 VPN client. Just need to figure out where the breakdown is happening but that is an entirely different question. I was mainly just curious as to why the UDP for my VPN connection show as close but I am apparently able to receive traffic on them.

2
  • That is going to depend on the specific equipment. What is your router model and configurations?
    – Ron Maupin
    Apr 7, 2020 at 22:03
  • @RonMaupin I updated the question. Sorry. Didn't realize I was asking an equipment specific question.
    – ahelton
    Apr 7, 2020 at 23:47

1 Answer 1

1

UDP is not a connection-oriented protocol the way TCP is. Sending something to an open TCP port will normally get a response, even if it is a RST. On the other hand UDP does not establish a connection before sending or receiving data, so you really cannot tell if the UDP port is open the way you can with TCP.

Sending a SYN to an open TCP port should get back a segment with ACK/SYN. UDP does not have any type of handshake to determine if the port is open.


Your VPN problem could very well be, and probably is, something completely different. By the way, L2TP is a poor choice for a VPN, and you should really do more research before committing your business to that.

1
  • Thanks. That makes sense. Oh, and it is just a lab. Not a business :). I am just following along in a book to learn about what features are in Windows Server. I am sure my VPN issue lies elsewhere as well.
    – ahelton
    Apr 8, 2020 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.