I noticed yesterday that when I run an NMAP against the external interface of my OpenBSD firewall it shows ports in the "filtered" state, that I know nothing about. In the past it would only show the ports that I purposely opened in the PF.CONF file. I don't know what changed, that's making me now see these "filtered" ports. Below is output from NMAP.
Starting Nmap 4.10 (
http://www.insecure.org/nmap ) at 2008-02-28 08:18 Eastern Standard Time
Interesting ports on email.eoc.psu.edu (128.118.20.198):
Not shown: 1661 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
80/tcp open http
554/tcp filtered rtsp
1025/tcp open NFS-or-IIS
1720/tcp filtered H.323/Q.931
2000/tcp filtered callbook
3389/tcp open ms-term-serv
5060/tcp filtered sip
49400/tcp filtered compaqdiag
50000/tcp filtered iiimsf
50002/tcp filtered iiimsf
54320/tcp filtered bo2k
61439/tcp filtered netprowler-manager
61440/tcp filtered netprowler-manager2
61441/tcp filtered netprowler-sensor
65301/tcp filtered pcanywhere
Nmap finished: 1 IP address (1 host up) scanned in 2.250 seconds
The ports in the OPEN state, are the ones that I opened on purpose. The ones in the filtered state, I know nothing about. Below is my pf.conf file
# VARIABLES
ext_if="xl1"
int_if="xl0"
tcp_services="{ 1025 }"
icmp_types="echoreq"
ssh="192.168.1.3"
web="192.168.1.3"
email="192.168.1.2"
ftp_server="192.168.1.3"
# OPTIONS
set block-policy return
set loginterface $ext_if
set skip on lo
# SCRUB
scrub in
# NAT/RDR
nat on $ext_if from !($ext_if) -> ($ext_if:0)
################# FTP ##################
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
rdr on $ext_if proto tcp from any to any port 21 -> $ftp_server port 21
rdr on $ext_if proto tcp from any to any port 49152:65535 -> \
$ftp_server port 49152:65535
################# FTP ##################
rdr on $ext_if proto tcp from any to any port 80 -> $web
rdr on $ext_if proto tcp from any to any port smtp -> $email
rdr on $ext_if proto tcp from any to any port 3389 -> $web
rdr on $ext_if proto tcp from any to any port 22 -> $ssh
# FILTER RULES
block in
pass out keep state
anchor "ftp-proxy/*"
antispoof quick for {lo $int_if }
pass in on $ext_if proto tcp from any to ($ext_if) \
port $tcp_services flags S/SA keep state
pass in on $ext_if proto tcp from any to $web port 80 \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $web port 3389 \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $email port smtp \
flags S/SA synproxy state
pass in on $ext_if proto tcp from any to $ssh port 22 \
flags S/SA synproxy state
################# FTP #################
pass in quick on $ext_if proto tcp from any to $ftp_server \
port 21 keep state
pass in quick on $ext_if proto tcp from any to $ftp_server \
port > 49151 keep state
pass out quick on $int_if proto tcp from any to $ftp_server \
port 21 keep state
pass out quick on $int_if proto tcp from any to $ftp_server \
port > 49151 keep state
################# FTP #################
pass in inet proto icmp all icmp-type $icmp_types keep state
pass quick on $int_if
