Firewall and IDS/IPS Evasion
Nmap gives you several ways to work around firewall rules and IDS/IPS controls. These methods include packet fragmentation, decoys, custom source settings, and other techniques that reduce how obvious your scans look.Firewalls
A firewall is a security control that blocks or permits connection attempts from external networks. Every firewall is built around a software component that monitors traffic between the host and incoming connections, then decides how to handle each packet based on configured rules. The firewall can pass, ignore, or block individual network packets. This mechanism is designed to prevent unwanted connections that could be dangerous.IDS/IPS
Like a firewall, an intrusion detection system (IDS) and intrusion prevention system (IPS) are software-based security controls. IDS monitors the network for potential attacks, analyzes suspicious activity, and reports what it finds. IPS extends this by taking defensive action automatically when it detects traffic that matches configured rules. These systems often rely on pattern matching and signatures. If they detect recognizable scan behavior, such as aggressive service detection, they may flag or block the traffic.Determine Firewalls and Their Rules
When Nmap shows a port asfiltered, several explanations are possible. In many cases, a firewall is enforcing rules for that connection attempt. The packet may be dropped or rejected.
Dropped packets are ignored and generate no response. Rejected packets trigger an explicit reply. TCP packets are commonly rejected with the RST flag, while ICMP responses may include different error codes.
Common ICMP errors include:
- Net Unreachable
- Net Prohibited
- Host Unreachable
- Host Prohibited
- Port Unreachable
- Proto Unreachable
-sA) is often harder for firewalls and IDS/IPS controls to filter than SYN (-sS) or connect (-sT) scans because it sends a packet with only the ACK flag set. If the target port is open or closed, the host typically replies with RST.
By contrast, new inbound connection attempts that start with SYN are more likely to be filtered by a firewall. ACK packets are sometimes allowed through because the firewall cannot always tell whether the connection originated externally or from inside the network.
If you compare these scans, the difference becomes visible quickly.
SYN Scan
ACK Scan
| Scanning Option | Description |
|---|---|
10.129.2.28 | Scan the specified target. |
-p 21,22,25 | Scan only the specified ports. |
-sS | Perform a SYN scan on the specified ports. |
-sA | Perform an ACK scan on the specified ports. |
-Pn | Disable ICMP echo requests. |
-n | Disable DNS resolution. |
--disable-arp-ping | Disable ARP ping. |
--packet-trace | Show all packets sent and received. |
RCVD packets and the flags returned by the target. With the SYN scan (-sS), the target tries to establish the TCP connection by returning a packet with SYN-ACK (SA) set. With the ACK scan (-sA), you receive RST because TCP port 22 is open. For TCP port 25, the target sends nothing back, which indicates that the packets are being dropped.
Detect IDS/IPS
Unlike firewall detection, identifying IDS/IPS controls is much harder because these are often passive traffic-monitoring systems. IDS reviews connections between hosts and looks for traffic that matches predefined content, signatures, or behavior. If it finds a match, it alerts an administrator. IPS goes one step further and can block traffic automatically based on administrator-defined rules. IDS and IPS are separate functions, even when they operate together. During a penetration test, using several VPS hosts with different IP addresses can help you determine whether these controls are active. If one host suddenly loses access to the target network, that is often a strong sign that defensive action has been taken against that source. IDS by itself is usually intended to help administrators detect suspicious traffic and decide how to respond. You can sometimes trigger defensive action by scanning a service too aggressively. When that happens, you learn that the network is being watched and that future scans need to be quieter and better disguised. One simple test is to scan from a single VPS and watch for a sudden loss of access. If that source gets blocked, continue only from another controlled host and reduce how noisy your probes are.Decoys
Sometimes administrators block traffic from specific regions or subnets by default. In other cases, IPS may respond directly to your source IP. For these situations, decoy scanning with-D can help disguise where the packets came from.
With this option, Nmap inserts additional IP addresses into the packet headers. You can generate random decoys with RND, followed by a number such as 5. Nmap places your real IP somewhere among those decoys. In the next example, the real source appears in the second position.
The decoys must be alive. If they are not, the target service may become unreachable because SYN flood protections can react badly to obviously fake traffic.
Scan by Using Decoys
| Scanning Option | Description |
|---|---|
10.129.2.28 | Scan the specified target. |
-p 80 | Scan only the specified port. |
-sS | Perform a SYN scan on the specified port. |
-Pn | Disable ICMP echo requests. |
-n | Disable DNS resolution. |
--disable-arp-ping | Disable ARP ping. |
--packet-trace | Show all packets sent and received. |
-D RND:5 | Generate five random IP addresses as decoys for the scan source. |
-S to test whether a more trusted address changes the result. Decoys can be used with SYN, ACK, ICMP, and OS detection scans.
Testing a Firewall Rule
Scan by Using a Different Source IP
| Scanning Option | Description |
|---|---|
10.129.2.28 | Scan the specified target. |
-n | Disable DNS resolution. |
-Pn | Disable ICMP echo requests. |
-p 445 | Scan only the specified port. |
-O | Perform operating system detection. |
-S | Set a different source IP address for the scan. |
10.129.2.200 | Use this IP as the scan source. |
-e tun0 | Send requests through the specified interface. |
DNS Proxying
By default, Nmap performs reverse DNS resolution unless you disable it. These DNS queries are often allowed because the target’s services are expected to be reachable. DNS usually uses UDP port 53, while TCP port 53 has historically been used for zone transfers or responses larger than 512 bytes. With IPv6 and DNSSEC, TCP 53 is more common than it used to be. Nmap lets you define your own DNS servers with--dns-server <ns>,<ns>. This can be valuable when you are operating from a DMZ, where internal DNS servers may be more trusted than public ones.
You can also use TCP port 53 as the source port with --source-port. If the administrator permits traffic based on that port and IDS/IPS filtering is weak, those packets may be treated as trusted and allowed through.
SYN Scan of a Filtered Port
SYN Scan from DNS Port
| Scanning Option | Description |
|---|---|
10.129.2.28 | Scan the specified target. |
-p 50000 | Scan only the specified port. |
-sS | Perform a SYN scan on the specified port. |
-Pn | Disable ICMP echo requests. |
-n | Disable DNS resolution. |
--disable-arp-ping | Disable ARP ping. |
--packet-trace | Show all packets sent and received. |
--source-port 53 | Send the scan from source port 53. |