hostname e ip mostra registro diferente para a porta 4444. por que?

Question

Estou tentando bloquear todas as portas de sistemas que aceitam 4444 no Kali Linux. Eu adicionei 4444 no meu iptables e reiniciei o serviço iptables.

agora nmap hostname -p 4444 está exibindo-o como porta aberta, mas quando estou usando meu sistema IP 192.168.1.3 , em seguida, mostrando 4444 como fechado

    $ nmap linux -p 4444
    Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-24 15:42 +0430
    sendto in send_ip_packet_sd: sendto(4, packet, 44, 0, 127.0.1.1, 16) => Operation not permitted
    Offending packet: TCP 127.0.0.1:50026 > 127.0.1.1:4444 S ttl=44 id=30247 iplen=44  seq=3026860575 win=1024 <mss 1460>
    sendto in send_ip_packet_sd: sendto(4, packet, 44, 0, 127.0.1.1, 16) => Operation not permitted
    Offending packet: TCP 127.0.0.1:50027 > 127.0.1.1:4444 S ttl=53 id=24606 iplen=44  seq=3026926110 win=1024 <mss 1460>
    Nmap scan report for linux (127.0.1.1)
    Host is up.
    rDNS record for 127.0.1.1: Linux.domain.linux

    PORT     STATE    SERVICE
    4444/tcp filtered krb524

    Nmap done: 1 IP address (1 host up) scanned in 2.11 seconds


    $ nmap 192.168.1.3 -p 4444
    Starting Nmap 7.70 ( https://nmap.org ) at 2018-05-24 15:43 +0430
    Nmap scan report for 192.168.1.3
    Host is up (0.000022s latency).

    PORT     STATE  SERVICE
    4444/tcp closed krb524

    Nmap done: 1 IP address (1 host up) scanned in 13.22 seconds


    $ hostname
    Linux

    $ ifconfig
    eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
            ether ec:f4:bb:2f:a2:d9  txqueuelen 1000  (Ethernet)
            RX packets 0  bytes 0 (0.0 B)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 0  bytes 0 (0.0 B)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
            device interrupt 20  memory 0xf7e00000-f7e20000  

    lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
            inet 127.0.0.1  netmask 255.0.0.0
            loop  txqueuelen 1000  (Local Loopback)
            RX packets 63438  bytes 78026474 (74.4 MiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 63438  bytes 78026474 (74.4 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
            inet 10.115.210.220  netmask 255.255.254.0  destination 10.115.210.220
            unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 100  (UNSPEC)
            RX packets 182  bytes 69832 (68.1 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 234  bytes 40743 (39.7 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 192.168.1.3  netmask 255.255.255.0  broadcast 192.168.1.255
            inet6 fe80::8286:f2ff:fe6e:59e2  prefixlen 64  scopeid 0x20<link>
            ether 80:86:f2:6e:59:e2  txqueuelen 1000  (Ethernet)
            RX packets 387176  bytes 530891372 (506.2 MiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 357454  bytes 58810528 (56.0 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    

Answer 1

Seu nome de host linux não mapeia para seu endereço IP externo 192.168.1.3 , mas para a interface de loopback como mostrado em: Nmap scan report for linux (127.0.1.1) , o que explicaria um resultado diferente em comparação com a varredura da interface externa.

Você não exibe sua configuração de firewall, mas normalmente as regras de firewall são diferentes para a interface de loopback (os conjuntos de regras típicos incluem iptables -I INPUT -i lo -j ACCEPT para aceitar todo o tráfego interno de um sistema)