Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4630 > unrolled thread

ftp,ssh,http blocked by ISP?

Back to article view | Back to comp.os.linux.networking

Contents

  ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-18 12:38 +0000
    Re: ftp,ssh,http blocked by ISP? Dan Purgert <dan@djph.net> - 2020-07-18 14:59 +0000
      Re: ftp,ssh,http blocked by ISP? William Unruh <unruh@invalid.ca> - 2020-07-18 15:15 +0000
        Re: ftp,ssh,http blocked by ISP? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2020-07-18 20:01 +0300
          Re: ftp,ssh,http blocked by ISP? William Unruh <unruh@invalid.ca> - 2020-07-18 22:06 +0000
      Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-18 16:35 +0000
    Re: ftp,ssh,http blocked by ISP? Ken Hart <kwhart1@frontier.com> - 2020-07-18 11:12 -0400
      Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-18 16:44 +0000
    Re: ftp,ssh,http blocked by ISP? John McCue <jmccue@jmclin1.hsd1.ma.comcast.net> - 2020-07-18 16:33 +0000
    Re: ftp,ssh,http blocked by ISP? Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2020-07-18 13:26 -0400
      Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-18 17:56 +0000
        Re: ftp,ssh,http blocked by ISP? Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2020-07-18 14:36 -0400
          Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-18 19:06 +0000
            Re: ftp,ssh,http blocked by ISP? William Unruh <unruh@invalid.ca> - 2020-07-18 22:13 +0000
              Re: ftp,ssh,http blocked by ISP? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2020-07-18 19:36 -0400
                Re: ftp,ssh,http blocked by ISP? "Carlos E.R." <robin_listas@es.invalid> - 2020-07-19 12:56 +0200
                  Re: ftp,ssh,http blocked by ISP? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-07-28 21:26 -0700
                    Re: ftp,ssh,http blocked by ISP? "Carlos E.R." <robin_listas@es.invalid> - 2020-07-29 10:40 +0200
                      Re: ftp,ssh,http blocked by ISP? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-08-01 21:22 -0700
                        Re: ftp,ssh,http blocked by ISP? "Carlos E.R." <robin_listas@es.invalid> - 2020-08-02 13:16 +0200
                          Re: ftp,ssh,http blocked by ISP? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-08-03 13:57 -0700
                            Re: ftp,ssh,http blocked by ISP? "Carlos E.R." <robin_listas@es.invalid> - 2020-08-03 23:07 +0200
              Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-19 01:40 +0000
                Re: ftp,ssh,http blocked by ISP? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2020-07-18 22:10 -0400
                Re: ftp,ssh,http blocked by ISP? "Carlos E.R." <robin_listas@es.invalid> - 2020-07-19 12:59 +0200
    Re: ftp,ssh,http blocked by ISP? Giovanni <lsodgf0@home.net.it> - 2020-07-19 10:10 +0200
    Re: ftp,ssh,http blocked by ISP? Marc Haber <mh+usenetspam1118@zugschl.us> - 2020-07-19 15:09 +0200
      Re: ftp,ssh,http blocked by ISP? William Unruh <unruh@invalid.ca> - 2020-07-19 17:35 +0000
        Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-20 02:33 +0000
          Re: ftp,ssh,http blocked by ISP? William Unruh <unruh@invalid.ca> - 2020-07-20 02:55 +0000
          Re: ftp,ssh,http blocked by ISP? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2020-07-19 23:32 -0400
          Re: ftp,ssh,http blocked by ISP? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2020-07-19 23:46 -0400
            Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-20 06:01 +0000
              Re: ftp,ssh,http blocked by ISP? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2020-07-20 20:16 -0400
              Re: ftp,ssh,http blocked by ISP? Johann Beretta <beretta@nun-ya-bizness.com> - 2020-08-01 21:24 -0700
          Re: ftp,ssh,http blocked by ISP? Giovanni <lsodgf0@home.net.it> - 2020-07-20 09:10 +0200
            Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-20 11:31 +0000
              Re: ftp,ssh,http blocked by ISP? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2020-07-20 17:49 +0300
                Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-20 15:32 +0000
                  Re: ftp,ssh,http blocked by ISP? Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2020-07-20 21:01 +0300
                  Re: ftp,ssh,http blocked by ISP? Bit Twister <BitTwister@mouse-potato.com> - 2020-07-20 13:04 -0500
              Re: ftp,ssh,http blocked by ISP? William Unruh <unruh@invalid.ca> - 2020-07-20 20:11 +0000
                Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-20 20:42 +0000
                  Re: ftp,ssh,http blocked by ISP? William Unruh <unruh@invalid.ca> - 2020-07-20 21:11 +0000
                    Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-21 01:52 +0000
                      Re: ftp,ssh,http blocked by ISP? dyrmak <dyrmak@quelite.terre.invalid> - 2020-07-21 08:35 +0000
    Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-21 10:34 +0000
      Re: ftp,ssh,http blocked by ISP? Giovanni <lsodgf0@home.net.it> - 2020-07-21 13:48 +0200
        Re: ftp,ssh,http blocked by ISP? Bob Tennent <rdtennent@tennent.ca> - 2020-07-21 13:35 +0000
          Re: ftp,ssh,http blocked by ISP? "Carlos E.R." <robin_listas@es.invalid> - 2020-07-21 16:03 +0200

Page 1 of 3  [1] 2 3  Next page →

#4630 — ftp,ssh,http blocked by ISP?

For years I've used port-forwarding in my router to allow
external access to ftp, ssh, and http servers. Recently,
this no longer works. The servers are running normally and
can be accessed internally. I can even access them via the
router IP address, showing that port-forwarding is still
working. I've also tried port-fowarding and DMZ in the
modem, to no avail. So my conjecture is that the ISP has
decided to block packets it considers unworthy before they
reach the modem.

Is this at all likely? How can I test/confirm the
conjecture? If it is confirmed, what can I do? Needless to
say, ISP "technical support" has so far been useless.

Bob T.

[toc] | [next] | [standalone]

#4631

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Bob Tennent wrote:
> For years I've used port-forwarding in my router to allow
> external access to ftp, ssh, and http servers. Recently,
> this no longer works. The servers are running normally and
> can be accessed internally. I can even access them via the
> router IP address, showing that port-forwarding is still
> working. I've also tried port-fowarding and DMZ in the
> modem, to no avail. So my conjecture is that the ISP has
> decided to block packets it considers unworthy before they
> reach the modem.
>
> Is this at all likely? How can I test/confirm the
> conjecture? If it is confirmed, what can I do? Needless to
> say, ISP "technical support" has so far been useless.

Just for giggles, is your gateway showing an IP address in RFC1918 or
RFC6598 space?  Also if you're using DNS, is the DNS pointing at the
right IP address still (e.g. ISP hasn't handed out a new address instead
of what you've had in the past).


-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3asj+xn6fYUcweBnbWVw5UznKGAFAl8TDmIACgkQbWVw5Uzn
KGBcdhAAmKGOkc9iytbZ44anP3UzhAOHiZFExRAPfws7s7A8xxFIknXnQxdik83+
5LJS62RR1gcN8z6nHjwUUOtaDc8h0R5j0Z1aMjA+lu+gfn29mbJyYmtczGlnb6u5
xu7c4Cz8U9PSrfW0ObtuxeMioEeWqhEXZ8pASs1Z2MI5+IxrT1VOJMZUqT3JzWAH
ZbfXFnZWa/4uQtuyq0pQihqvhwUjrbGMj+6FYdcvCLTvsTgNG/xLS1rHE4Zf90sV
6BHrLQGoY7DSVdc+QJIE2yCw5GyvJ6pmgHOwAyFzrZkCgEkIlyC8bMS2zFvDdFLS
3Nom4UXOD9eLRfuAAtCIzps/YmY2LX2oIg+sPLxNEjFClrnCBZ5xM24LJ/XyyIAF
CNxWZticXMMrwpwYy9WoRBxlggVhcL2kCYRsOALT4DIV3mnH3l9ymmBC4cuPSqu8
p5JAgk9txDPoMiZv85cSeaZL75+IqAv6KrfOpqSoFBiWZOnVbcuYRBCE5SWSFdGD
gVpXvjWRAXswV2LAfIcLLhhZBYuw8kJkA7sYCIijFCuiWR0dauNfSmY+JJqkGTHY
2sKzZK7PU2TD39aeXCcq68dNT5kdgi+7Ub6B/Tlh3I872pSYK03aVJKpBGwMXD18
kCXTHnD8ivdpMuQD8YVbDprRrzYlkECaePJWPHXhQR59OJrKRrE=
=15SK
-----END PGP SIGNATURE-----

-- 
|_|O|_| Github: https://github.com/dpurgert
|_|_|O| PGP: DDAB 23FB 19FA 7D85 1CC1  E067 6D65 70E5 4CE7 2860
|O|O|O| Former PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4633

On 2020-07-18, Dan Purgert <dan@djph.net> wrote:


>
> Bob Tennent wrote:
>> For years I've used port-forwarding in my router to allow
>> external access to ftp, ssh, and http servers. Recently,
>> this no longer works. The servers are running normally and
>> can be accessed internally. I can even access them via the
>> router IP address, showing that port-forwarding is still
>> working. I've also tried port-fowarding and DMZ in the
>> modem, to no avail. So my conjecture is that the ISP has
>> decided to block packets it considers unworthy before they
>> reach the modem.
>>
>> Is this at all likely? How can I test/confirm the
>> conjecture? If it is confirmed, what can I do? Needless to
>> say, ISP "technical support" has so far been useless.
>
> Just for giggles, is your gateway showing an IP address in RFC1918 or
> RFC6598 space?  Also if you're using DNS, is the DNS pointing at the
> right IP address still (e.g. ISP hasn't handed out a new address instead
> of what you've had in the past).

Just to amplify, can you ssh out to some server somewhere? Or you can go
to 
https://portforward.com/networking/routers_ip_address.htm
and at the bottom of the page will be listed your router's external IP
address, the one you have to ssh/ftp/... to to get your port forwarding
done. 
If, using that IP you get nothing from your router,  make sure first that
your router's firewall is not blocking incoming packets to the say port
23 (ssh) . 
As He says, remember that the ISP reserves the right to change that IP
address wihout warning. Thus you need some way of finding out that IP
address constantly and letting those machines that need to contact yours
what the IP address is of the router when it changes. 
If you have set up your system to go through a vpn, then there is no way
that an outsider can get at your system. That is the purpose of a vpn. 
You can sometimes add those external systems that need to get through to
you to the routing on your computer so that those addresses are not
routed through the vpn, but go directly so you can contact them when
your router ip address changes for them and change their own routing
tables.

>

[toc] | [prev] | [next] | [standalone]

#4637

On 18.7.20 18.15, William Unruh wrote:
> On 2020-07-18, Dan Purgert <dan@djph.net> wrote:
> 
> 
>>
>> Bob Tennent wrote:
>>> For years I've used port-forwarding in my router to allow
>>> external access to ftp, ssh, and http servers. Recently,
>>> this no longer works. The servers are running normally and
>>> can be accessed internally. I can even access them via the
>>> router IP address, showing that port-forwarding is still
>>> working. I've also tried port-fowarding and DMZ in the
>>> modem, to no avail. So my conjecture is that the ISP has
>>> decided to block packets it considers unworthy before they
>>> reach the modem.
>>>
>>> Is this at all likely? How can I test/confirm the
>>> conjecture? If it is confirmed, what can I do? Needless to
>>> say, ISP "technical support" has so far been useless.
>>
>> Just for giggles, is your gateway showing an IP address in RFC1918 or
>> RFC6598 space?  Also if you're using DNS, is the DNS pointing at the
>> right IP address still (e.g. ISP hasn't handed out a new address instead
>> of what you've had in the past).
> 
> Just to amplify, can you ssh out to some server somewhere? Or you can go
> to
> https://portforward.com/networking/routers_ip_address.htm
> and at the bottom of the page will be listed your router's external IP
> address, the one you have to ssh/ftp/... to to get your port forwarding
> done.
> If, using that IP you get nothing from your router,  make sure first that
> your router's firewall is not blocking incoming packets to the say port
> 23 (ssh) .
> As He says, remember that the ISP reserves the right to change that IP
> address wihout warning. Thus you need some way of finding out that IP
> address constantly and letting those machines that need to contact yours
> what the IP address is of the router when it changes.
> If you have set up your system to go through a vpn, then there is no way
> that an outsider can get at your system. That is the purpose of a vpn.
> You can sometimes add those external systems that need to get through to
> you to the routing on your computer so that those addresses are not
> routed through the vpn, but go directly so you can contact them when
> your router ip address changes for them and change their own routing
> tables.


SSH is port 22. Port 23 is Telnet, which should NOT be publicly visible.

-- 

-TV

[toc] | [prev] | [next] | [standalone]

#4642

On 2020-07-18, Tauno Voipio <tauno.voipio@notused.fi.invalid> wrote:
>
> SSH is port 22. Port 23 is Telnet, which should NOT be publicly visible.

Of course you are right. Sorry.
>

[toc] | [prev] | [next] | [standalone]

#4635

On Sat, 18 Jul 2020 14:59:46 -0000 (UTC), Dan Purgert wrote:
 >
 > Bob Tennent wrote:
 >> For years I've used port-forwarding in my router to allow
 >> external access to ftp, ssh, and http servers. Recently,
 >> this no longer works. The servers are running normally and
 >> can be accessed internally. I can even access them via the
 >> router IP address, showing that port-forwarding is still
 >> working. I've also tried port-fowarding and DMZ in the
 >> modem, to no avail. So my conjecture is that the ISP has
 >> decided to block packets it considers unworthy before they
 >> reach the modem.
 >>
 >> Is this at all likely? How can I test/confirm the
 >> conjecture? If it is confirmed, what can I do? Needless to
 >> say, ISP "technical support" has so far been useless.
 >
 > Just for giggles, is your gateway showing an IP address in RFC1918 or
 > RFC6598 space?  

I don't know what that means. 

 > Also if you're using DNS, is the DNS pointing at the
 > right IP address still (e.g. ISP hasn't handed out a new
 > address instead of what you've had in the past).

Yes. I use ddclient to keep the IP address up-to-date. In
any case, connecting directly to the (current) IP address
doesn't work either/

[toc] | [prev] | [next] | [standalone]

#4632

On 7/18/20 8:38 AM, Bob Tennent wrote:
> For years I've used port-forwarding in my router to allow
> external access to ftp, ssh, and http servers. Recently,
> this no longer works. The servers are running normally and
> can be accessed internally. I can even access them via the
> router IP address, showing that port-forwarding is still
> working. I've also tried port-fowarding and DMZ in the
> modem, to no avail. So my conjecture is that the ISP has
> decided to block packets it considers unworthy before they
> reach the modem.
> 
> Is this at all likely? How can I test/confirm the
> conjecture? If it is confirmed, what can I do? Needless to
> say, ISP "technical support" has so far been useless.
> 
> Bob T.
> 

Try this site for starters:
whatismybrowser.com
Click on "Detect my settings"
Go down to Detect Network/Internet Details
Click on "Is my ISP filtering my outgoing network ports?"

My "not at all in depth" research shows that some ISP's do block certain 
ports. Maybe because of abuse in the past, maybe because they want to 
sell you a more expensive package.


This site suggests changing your SSH port to 443, which is used for https:

https://www.digitalocean.com/community/questions/how-to-access-port-22-if-isp-has-blocked-port-22


This site suggests changing the port to a random port. The problem is 
finally resolved (spoiler alert!) when the o. p. checks more deeply into 
his modem/router and discovers that port 22 has to be set up manually. 
BTW, I had to do this on my Netgear router from Frontier.

https://www.lowendtalk.com/discussion/40515/isp-blocks-ssh-port-22-workarounds

-- 
Ken Hart
kwhart1@frontier.com

[toc] | [prev] | [next] | [standalone]

#4636

On Sat, 18 Jul 2020 11:12:47 -0400, Ken Hart wrote:
 > On 7/18/20 8:38 AM, Bob Tennent wrote:
 >> For years I've used port-forwarding in my router to allow
 >> external access to ftp, ssh, and http servers. Recently,
 >> this no longer works. The servers are running normally and
 >> can be accessed internally. I can even access them via the
 >> router IP address, showing that port-forwarding is still
 >> working. I've also tried port-fowarding and DMZ in the
 >> modem, to no avail. So my conjecture is that the ISP has
 >> decided to block packets it considers unworthy before they
 >> reach the modem.
 >> 
 >> Is this at all likely? How can I test/confirm the
 >> conjecture? If it is confirmed, what can I do? Needless to
 >> say, ISP "technical support" has so far been useless.
 >> 
 >> Bob T.
 >> 
 >
 > Try this site for starters:
 > whatismybrowser.com
 > Click on "Detect my settings"
 > Go down to Detect Network/Internet Details
 > Click on "Is my ISP filtering my outgoing network ports?"

The problem is *incoming* packets. Not necessarily from my
browser.

 > My "not at all in depth" research shows that some ISP's do block certain 
 > ports. Maybe because of abuse in the past, maybe because they want to 
 > sell you a more expensive package.
 >
 > This site suggests changing your SSH port to 443, which is used for https:
 >
 > https://www.digitalocean.com/community/questions/
     how-to-access-port-22-if-isp-has-blocked-port-22
 >
 > This site suggests changing the port to a random port. The problem is 
 > finally resolved (spoiler alert!) when the o. p. checks more deeply into 
 > his modem/router and discovers that port 22 has to be set up manually. 
 > BTW, I had to do this on my Netgear router from Frontier.
 >
 > https://www.lowendtalk.com/discussion/40515/
     isp-blocks-ssh-port-22-workarounds

I use 22xx as both the incoming port and the port used by
sshd. Has been working for years. Similar apparent blocking
issues with ftp and http, though I use standard port numbers
for them

[toc] | [prev] | [next] | [standalone]

#4634

Bob Tennent <rdtennent@tennent.ca> wrote:
> For years I've used port-forwarding in my router to allow
> external access to ftp, ssh, and http servers. Recently,
> this no longer works. The servers are running normally and
> can be accessed internally. I can even access them via the
> router IP address, showing that port-forwarding is still
> working. I've also tried port-fowarding and DMZ in the
> modem, to no avail. So my conjecture is that the ISP has
> decided to block packets it considers unworthy before they
> reach the modem.

Did your IP address change ?
Most cases for me, it would be a changed IP Address,
to fix you need to tie your MAC address to a specific
IP using whatever tool you ISP provides.

Comcast did make changes for me a while ago and 
I had to go here to adjust:

https://internet.xfinity.com/network

> Is this at all likely? How can I test/confirm the
> conjecture? If it is confirmed, what can I do? Needless to
> say, ISP "technical support" has so far been useless.
> 
> Bob T.

[toc] | [prev] | [next] | [standalone]

#4638

On July 18, 2020 08:38, Bob Tennent wrote:

> For years I've used port-forwarding in my router to allow
> external access to ftp, ssh, and http servers. Recently,
> this no longer works. The servers are running normally and
> can be accessed internally. I can even access them via the
> router IP address, showing that port-forwarding is still
> working. I've also tried port-fowarding and DMZ in the
> modem, to no avail. So my conjecture is that the ISP has
> decided to block packets it considers unworthy before they
> reach the modem.
> 
> Is this at all likely?

Yes, it is likely. Many big ISPs block "server" ports, especially
on their "consumer"-level offerings. It is possible that your
ISP has changed their policy, and is now blocking ports.

> How can I test/confirm the conjecture?

You could portscan your internet-facing IP address from outside
your lan. You could use
  https://pentest-tools.com/network-vulnerability-scanning/tcp-port-scanner-online-nmap
or
  https://www.grc.com/x/ne.dll?bh0bkyd2

> If it is confirmed, what can I do?

Either
 - move your services to ports not blocked by your ISP, or
 - lease a commercial-level offering from your ISP, or
 - get a new ISP

> Needless to say, ISP "technical support" has so far been useless.

Yah. And, if the ISP has a policy (see their "Terms Of Use")
of not permitting their clients to have servers, you /might/
run into a bit of "contract trouble" with your ISP if their
technical support reports you.

-- 
Lew Pitcher
"In Skills, We Trust"

[toc] | [prev] | [next] | [standalone]

#4639

On Sat, 18 Jul 2020 13:26:11 -0400, Lew Pitcher wrote:
 >
 >> How can I test/confirm the conjecture?
 >
 > You could portscan your internet-facing IP address from outside
 > your lan. You could use
 > https://pentest-tools.com/network-vulnerability-scanning/
     tcp-port-scanner-online-nmap

That looks promising but the free scan at least gives up if
pings are blocked. A ping-free scan is mentioned but I don't
know how to enable it.

Could I install nmap on a cloud computer and scan with that?

[toc] | [prev] | [next] | [standalone]

#4640

On July 18, 2020 13:56, Bob Tennent wrote:

> On Sat, 18 Jul 2020 13:26:11 -0400, Lew Pitcher wrote:
>  >
>  >> How can I test/confirm the conjecture?
>  >
>  > You could portscan your internet-facing IP address from outside
>  > your lan. You could use
>  > https://pentest-tools.com/network-vulnerability-scanning/
>      tcp-port-scanner-online-nmap
> 
> That looks promising but the free scan at least gives up if
> pings are blocked. A ping-free scan is mentioned but I don't
> know how to enable it.
> 
> Could I install nmap on a cloud computer and scan with that?

Certainly. Most of the portscan websites that I've looked into use nmap 
under the covers. 

-- 
Lew Pitcher
"In Skills, We Trust"

[toc] | [prev] | [next] | [standalone]

#4641

On Sat, 18 Jul 2020 14:36:56 -0400, Lew Pitcher wrote:
 > On July 18, 2020 13:56, Bob Tennent wrote:
 >
 >> On Sat, 18 Jul 2020 13:26:11 -0400, Lew Pitcher wrote:
 >>  >
 >>  >> How can I test/confirm the conjecture?
 >>  >
 >>  > You could portscan your internet-facing IP address from outside
 >>  > your lan. You could use
 >>  > https://pentest-tools.com/network-vulnerability-scanning/
 >>      tcp-port-scanner-online-nmap
 >> 
 >> That looks promising but the free scan at least gives up if
 >> pings are blocked. A ping-free scan is mentioned but I don't
 >> know how to enable it.
 >> 
 >> Could I install nmap on a cloud computer and scan with that?
 >
 > Certainly. Most of the portscan websites that I've looked into use nmap 
 > under the covers. 

OK, done.  But man nmap is completely incomprehensible to me.  I know
pings are blocked so I need -Pn.  When I do nmap -Pn myhost I get

998 filtered ports
22/tcp closed
50001 open

I could move my ftp and http stuff to the cloud computer.
That leaves ssh as the only essential service. If assume 22
and 22xx are blocked, could I use 50001 as my ssh port?

[toc] | [prev] | [next] | [standalone]

#4643

On 2020-07-18, Bob Tennent <rdtennent@tennent.ca> wrote:
> On Sat, 18 Jul 2020 14:36:56 -0400, Lew Pitcher wrote:
> > On July 18, 2020 13:56, Bob Tennent wrote:
> >
> >> On Sat, 18 Jul 2020 13:26:11 -0400, Lew Pitcher wrote:
> >>  >
> >>  >> How can I test/confirm the conjecture?
> >>  >
> >>  > You could portscan your internet-facing IP address from outside
> >>  > your lan. You could use
> >>  > https://pentest-tools.com/network-vulnerability-scanning/
> >>      tcp-port-scanner-online-nmap
> >> 
> >> That looks promising but the free scan at least gives up if
> >> pings are blocked. A ping-free scan is mentioned but I don't
> >> know how to enable it.
> >> 
> >> Could I install nmap on a cloud computer and scan with that?
> >
> > Certainly. Most of the portscan websites that I've looked into use nmap 
> > under the covers. 
>
> OK, done.  But man nmap is completely incomprehensible to me.  I know
> pings are blocked so I need -Pn.  When I do nmap -Pn myhost I get
>
> 998 filtered ports
> 22/tcp closed
> 50001 open
>
> I could move my ftp and http stuff to the cloud computer.
> That leaves ssh as the only essential service. If assume 22
> and 22xx are blocked, could I use 50001 as my ssh port?

You can use any number you want as your ssh port (of course if it is the
number of some crucial service then that could cause trouble) Then on
your router port forward that port to the computer/port you actually want to use. 

So, in your router port forward port 7916 to port 22 on your own
machine. Then have your remote machines connect via ssh to port 7916.
ssh -p 7916 <address of your router>

[toc] | [prev] | [next] | [standalone]

#4644

On Sat, 18 Jul 2020 18:13:07 -0400, William Unruh <unruh@invalid.ca> wrote:
> So, in your router port forward port 7916 to port 22 on your own
> machine. Then have your remote machines connect via ssh to port 7916.
> ssh -p 7916 <address of your router>

Since I switched from an adsl connection to a cable connection, I found my isp
also blocks incoming tcp connections on ports less than 1025.

The approach I use for ssh is to have my router set to forward a range of ports
to the system where I run sshd and other servers.

In /etc/ssh/sshd_config I have a line with "Port 33333" so sshd listens on that
port.

On the the system that connects to my sshd server, in the user's .ssh/config
file I have ...
Host mine
Hostname my.host.name
Port 33333
User dave
ServerAliveInterval 120

So when "ssh mine" is run on the system connecting to my sshd server, it connects
to tcp port 33333 on the system identified by the hostname my.host.name.

I use an actual name rather then my.host.name, and a port other then 33333.

The dns for my system is set up using dyndns, and the ssh connection is set up
as part of using autossh, to allow me to use a reverse ssh connection to access
the remote system, so the configs are a bit more complicated than the above, but
it should give an idea of one way to set things up.

One way to confirm the standard ports are blocked is using Shield up from
https://www.grc.com/intro.htm to have it run an nmap scan of your system.

Regards, Dave Hodgins

-- 
Change dwhodgins@nomail.afraid.org to davidwhodgins@teksavvy.com for
email replies.

[toc] | [prev] | [next] | [standalone]

#4648

On 19/07/2020 01.36, David W. Hodgins wrote:
> On Sat, 18 Jul 2020 18:13:07 -0400, William Unruh <unruh@invalid.ca> wrote:
>> So, in your router port forward port 7916 to port 22 on your own
>> machine. Then have your remote machines connect via ssh to port 7916.
>> ssh -p 7916 <address of your router>
> 
> Since I switched from an adsl connection to a cable connection, I found 
> my isp
> also blocks incoming tcp connections on ports less than 1025.

I find that manipulation bewildering. My ISP has its quirks, but it 
doesn't block any port at all. Not even 25. I am a plain home customer...

It does GNAT on phones, though, which of course impedes any incoming 
connection.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4678

[Multipart message — attachments visible in raw view] — view raw

On 7/19/20 3:56 AM, Carlos E.R. wrote:

> 
> I find that manipulation bewildering. My ISP has its quirks, but it
> doesn't block any port at all. Not even 25. I am a plain home customer...
> 
> It does GNAT on phones, though, which of course impedes any incoming
> connection.
> 

Failure to block port 25 (outbound) on dynamic or home connections is
one of the criteria for ending up on a SORBS type list.

Any ISP that fails to block that outbound port (opening up at a
customer's request is fine) by default isn't "awesome" it makes them
a-holes.

[toc] | [prev] | [next] | [standalone]

#4679

On 29/07/2020 06.26, Johann Beretta wrote:
> On 7/19/20 3:56 AM, Carlos E.R. wrote:
> 
>>
>> I find that manipulation bewildering. My ISP has its quirks, but it
>> doesn't block any port at all. Not even 25. I am a plain home customer...
>>
>> It does GNAT on phones, though, which of course impedes any incoming
>> connection.
>>
> 
> Failure to block port 25 (outbound) on dynamic or home connections is
> one of the criteria for ending up on a SORBS type list.
> 
> Any ISP that fails to block that outbound port (opening up at a
> customer's request is fine) by default isn't "awesome" it makes them
> a-holes.

AFAIK no ISP in Spain blocks that port, or any port for that matter. Nor 
outgoing, nor incoming. You can fight spammers differently, without 
assuming everybody is a criminal. Works fine.

In fact, mail to my ISP server is sent over 25, the submission port is 
closed.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

#4680

[Multipart message — attachments visible in raw view] — view raw

On 7/29/20 1:40 AM, Carlos E.R. wrote:

>> a-holes.
> 
> AFAIK no ISP in Spain blocks that port, or any port for that matter. Nor
> outgoing, nor incoming. You can fight spammers differently, without
> assuming everybody is a criminal. Works fine.
> 
> In fact, mail to my ISP server is sent over 25, the submission port is
> closed.
> 

You need not assume anyone is a criminal. That's a hell of a leap. But
it is a simple fact that home computers are infected by malware to a
fairly high percentage.

There's no damn reason that port 25 shouldn't be closed by default. I
have no problem with an ISP opening port 25 for a customer who requests
it, but to assume that any percentage of the general population is going
to go through the trouble of setting up a mail server, for personal use,
is idiotic.

Twenty or thirty years ago, sure.. fine.. Most people on the 'net back
then were much more computer savvy.. But it has become a commodity today.

For fuck's sake, most people never even bother to change the password on
their own wireless router.  You think they need port 25 open by default?

The only thing coming out of Port 25, for some fairly large chunk of the
populace, is SPAM and not a single goddamn other thing....

If ISPs in Spain aren't blocking port 25 as a rule, then they're all
assholes.

Seriously man, what percentage need 25 open? 1%?  0.01%?

[toc] | [prev] | [next] | [standalone]

#4682

On 02/08/2020 06.22, Johann Beretta wrote:
> On 7/29/20 1:40 AM, Carlos E.R. wrote:
> 
>>> a-holes.
>>
>> AFAIK no ISP in Spain blocks that port, or any port for that matter. Nor
>> outgoing, nor incoming. You can fight spammers differently, without
>> assuming everybody is a criminal. Works fine.
>>
>> In fact, mail to my ISP server is sent over 25, the submission port is
>> closed.
>>
> 
> You need not assume anyone is a criminal. That's a hell of a leap. But
> it is a simple fact that home computers are infected by malware to a
> fairly high percentage.
> 
> There's no damn reason that port 25 shouldn't be closed by default. I
> have no problem with an ISP opening port 25 for a customer who requests
> it, but to assume that any percentage of the general population is going
> to go through the trouble of setting up a mail server, for personal use,
> is idiotic.
> 
> Twenty or thirty years ago, sure.. fine.. Most people on the 'net back
> then were much more computer savvy.. But it has become a commodity today.
> 
> For fuck's sake, most people never even bother to change the password on
> their own wireless router.  You think they need port 25 open by default?
> 
> The only thing coming out of Port 25, for some fairly large chunk of the
> populace, is SPAM and not a single goddamn other thing....

Well, in Spain everybody needs to use port 25 to send mail legally and 
normally, because that's how the mail servers at the ISP are setup. My 
ISP refuses to set up the submission port at their side.

> 
> If ISPs in Spain aren't blocking port 25 as a rule, then they're all
> assholes.

Oh, thankyou.

> 
> Seriously man, what percentage need 25 open? 1%?  0.01%?

Everybody that sends mail here using a tool like Thunderbird or Outlook.

And there are no more problems with spam that elsewhere. Just try to 
send spam mail directly via the open port 25, it simply fails.

-- 
Cheers, Carlos.

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | comp.os.linux.networking

csiph-web