[APInoob42]

I was doing some security testing on my own home network and scanned my public IP address with Nmap.

The results were extremely weird.

Nmap reported a huge number of ports as open, including things like:

21 FTP
22 SSH
23 Telnet
25 SMTP
53 DNS
80 HTTP
443 HTTPS
445 SMB
3389 RDP
and hundreds of other ports

After around port 625, a massive number of them were shown as open tcpwrapped.

It seems very unlikely that my normal home router is actually running hundreds of Internet-facing services, so I'm wondering if this could be caused by my ISP, some kind of firewall/middlebox, SYN proxy, tarpitting, or Nmap misinterpreting the responses.

The strangest part is that Nmap's SMB vulnerability scripts reported:

445/tcp open microsoft-ds?

and:

CVE-2009-3103 - State: VULNERABLE

However, other SMB scripts timed out or couldn't negotiate a connection, and Nmap wasn't able to properly identify most of the services.

Has anyone seen behavior like this before?

Could something upstream be responding to connections on almost every port and making Nmap think they're open?

Also, what would be the best way to determine which ports are actually exposed by my router versus false positives / responses from ISP infrastructure?

I can post more of the Nmap output if needed.

[DramaKing]

Do I read you correctly that you tried scanning your public IP address from inside the network? That's like calling your own phone number. And that SMB script? It should only work against LanmanServer, not Samba. These results are too weird for you to have done a proper scan from an external network. Have you tried scanning the gateway address?

[APInoob42]

Do I read you correctly that you tried scanning your public IP address from inside the network? That's like calling your own phone number. And that SMB script? It should only work against LanmanServer, not Samba. These results are too weird for you to have done a proper scan from an external network. Have you tried scanning the gateway address?

Yeah, I scanned my public IP while I was still inside my home network. I didn’t realize NAT loopback could affect the results like that. That probably explains why I was seeing such a ridiculous number of open/tcpwrapped ports.

I’ll try scanning the public IP again from a completely external network, like through my phone hotspot, and compare it with a scan of my LAN gateway. Thanks, that clears up a lot.