Book now with code EOY2025
Forsaken_GA wrote: » How are you checking what ports are open? Are you doing it from behind the NAT to your global IP or are you doing it from the outside world? Let me give you an example - tyrion:~ root# nmap 192.168.1.13 Starting Nmap 4.20 ( Insecure.Org - Nmap Free Security Scanner, Tools & Hacking resources ) at 2010-02-06 11:09 EST PORT STATE SERVICE 21/tcp open ftp 53/tcp open domain 80/tcp open http 443/tcp open https This is from a host on the same subnet as the routers global IP. Those are the services I expect to see open from the outside world perspective porthos:~# nmap 192.168.1.13 Starting Nmap 4.62 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2010-02-06 11:20 EST Interesting ports on dorne.targaryen.local (192.168.1.13): Not shown: 1713 closed ports PORT STATE SERVICE 22/tcp open ssh 443/tcp open https That is from a host that's behind the NAT. Bit of a difference isn't it? If you're only seeing port 23 open, I suspect your running your port scans from behind your NAT, as port 23 should be the only port open, since you've disabled http server and http secure-server. Try running your port scan from a machine outside of your network, and you'll probably see that port 21 is open
fonestar1978 wrote: » I see what you're saying but NAT'd nmap scans have always been reliable for me from behind and outside my NAT'd LAN.
Forsaken_GA wrote: » With a Cisco router? Or with a Linksys? If you nmap a linksys from behind the nat to the outside global address, it will show you all the ports it has open. If you do the same with an IOS router (as I demonstrated above), it will not. Have you tried to nmap your outside global from outside of your network? If you have, is it still showing only the telnet port?
fonestar1978 wrote: » I should still be able to FTP into my WAN IP address and I cannot.
mikej412 wrote: » Is that your complete config above? Or just part of it? It looks like you have the ftp command port configured, but not the data port. Or should we just assume that you have everything correctly configured and that's it's a hardware issue? Are you saying you don't even see the static NAT translation for port 21 when you check the NAT translations?
Forsaken_GA wrote: » I think you're barking up the wrong tree and you have some other issues going on. Since you were kind enough to provide your global public IP in the last post, this is what happens when I try to FTP to the IP: tyrion:~ forsaken$ ftp 24.69.183.90 Connected to 24.69.183.90. 220 (vsFTPd 2.1.2) Name (24.69.183.90:forsaken): And pardon my rudeness, but I port scanned you as well: tyrion:~ forsaken$ sudo nmap 24.69.183.90 Password: Starting Nmap 4.20 ( Insecure.Org - Nmap Free Security Scanner, Tools & Hacking resources ) at 2010-02-06 22:22 EST Not shown: 1692 closed ports PORT STATE SERVICE 20/tcp filtered ftp-data 21/tcp open ftp 22/tcp open ssh 23/tcp open telnet 5900/tcp filtered vnc So you're showing your ports open to the world, but it looks like you have some internal network issues. And you need to fix this tyrion:~ forsaken$ telnet 24.69.183.90 Trying 24.69.183.90... Connected to S0106000f907d5ba0.gv.shawcable.net. Escape character is '^]'. User Access Verification Password:
fonestar1978 wrote: » Well, I was not aware before the other poster informed me that a nmap scan done within my lan was unreliable when working with IOS (as opposed to other routers). Thank-you for scanning my network, I was actually trying to VNC into my mom's computer to do the same thing but couldn't (lost her IP).
I know much is made about "don't use telnet, it's plain text" (scarry music in background). But honestly, this router is patched and do you or others you know or have the ability to deploy a sniffer on an ISP's wan??? Don't get me wrong, I've run ettercap, Back|Track, snort, Wireshark and the rest. But capturing plain text passwords on a lan and on a wan are two totally different things! Maybe if you capture an ISP's router and put it into promiscuous capture mode?? I've changed my vty password after I accidentally didn't blank all of them out of my first post and will go to sleep quite comfortably.
Use code EOY2025 to receive $250 off your 2025 certification boot camp!
