How can I prove (with logging) where a port block is occurring?
How can I prove (with logging) where a port block is occurring?
I've set up an FTP site on IIS (windows 7 home) and set up a rule in the Windows Firewall allowing access. The ftp site is accessible via my local browser to my static IP (ftp.example.com, where DNS is godaddy, so its resolving to my static IP and the ftp directory is being served). I've also set up a rule in my uVerse router firewall allowing FTP Server access to this machine. However, my customer cannot reach my FTP site, and when I test using mxtoolbox.com ..
1 open ports:
80 http Success 78 ms
These ports were closed:
21 ftp Timeout 0 ms
Furthermore, I can add other open ports, such as IMAP and POP3, and they show as open once I edit the router firewall. No matter how many times I delete and add FTP Server, port 21 never shows as open on mxtoolbox.com, and of course the customer cannot reach the FTP site. He can successfully reach my locally-hosted webpage.
Solution 1:
From the remote site, you can use traceroute to work out where in the path the port is blocked. Note that this has to be a *nix traceroute, eg linux, as Windows does not support traceroute over arbitrary ports.
Compare
sudo traceroute -p 21 -T <your server ip>
to
sudo traceroute -p 80 -T <your server ip>
These have to be run as root as it requires elevated privileges.
Note that it is the IP after the last successful hop that tells you where the block is - ie, the hop that does not respond. So look for the next hop in the port 80 traceroute after the last successful one in the port 21 traceroute.
Solution 2:
To check at which point or hop your port is being blocked use tracetcp. its very simple as below.
To check port 31 all the way to destination:
$ tracetcp www.ebay.co.uk:31
Tracing route to 66.135.192.41 [www.ebay.co.uk] on port 31
Over a maximum of 30 hops.
1 1 ms 1 ms 1 ms 192.168.0.1 [wintermute]
2 10 ms 13 ms 9 ms 10.78.128.1
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 ... continues until maximum number of hops reached.
you just need to install winpcap than this utility will work from Windows Cmd.
http://simulatedsimian.github.io/tracetcp_examples.html#scan-for-blocked-outgoing-ports