I decided yesterday morning to reflash my home firewall’s version of OpenWRT. This involved rebooting the router, of course, and when the router came up the friendly folks at Earthlink (or Time Warner Cable, depending on who runs the DHCP servers) had assigned my home cable modem a new IP address.
As I worked out a few issues with the new firmware, paring down modules and processes in order to make it all fit inside my modest little router, I decided to test the firewall rules to see whether things were working. From my server hosted outside of my network, I ran a simple nmap test to see which ports were open:
[root@tranquil /home/markt]# nmap -sT -P0 maestro.markturner.net
Starting Nmap 5.51 ( http://nmap.org ) at 2014-02-02 11:44 EST
Nmap scan report for maestro.markturner.net (24.40.133.50)
Host is up (0.035s latency).
rDNS record for 24.40.133.50: user-0c2h19i.cable.mindspring.com
Not shown: 955 closed ports, 40 filtered ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
587/tcp  open  submission
993/tcp  open  imaps
8080/tcp open  http-proxy
Nmap done: 1 IP address (1 host up) scanned in 6.86 seconds
That’s about what I expected, so I turned my attention to other issues, including running another test twenty minutes later:
[root@tranquil /home/markt]# nmap -sT -P0 maestro.markturner.net
Starting Nmap 5.51 ( http://nmap.org ) at 2014-02-02 12:04 EST
Nmap scan report for maestro.markturner.net (24.40.133.16)
Host is up (0.028s latency).
rDNS record for 24.40.133.16: user-0c2h18g.cable.mindspring.com
Not shown: 991 closed ports
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   open     smtp
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
587/tcp  open     submission
593/tcp  filtered http-rpc-epmap
993/tcp  open     imaps
8080/tcp open     http-proxy
Nmap done: 1 IP address (1 host up) scanned in 38.88 seconds
For the second test you can see I’ve got a few other ports showing up (TCP 135, 139, 445). These are supposedly filtered by the ISP somewhere down the line (probably the cable modem-level) to block clueless Windows users from exposing their networks to teh Internets.
You can see that these tests produced different results. It what was the same about these results, however, that caught my eye!
 Continue reading →