9

How can I prove (with logging) where a port block is occurring?

I've set up an FTP site on IIS (windows 7 home) and set up a rule in the Windows Firewall allowing access. The ftp site is accessible via my local browser to my static IP (ftp.example.com, where DNS is godaddy, so its resolving to my static IP and the ftp directory is being served). I've also set up a rule in my uVerse router firewall allowing FTP Server access to this machine. However, my customer cannot reach my FTP site, and when I test using mxtoolbox.com ..

1 open ports: 

80  http    Success 78 ms

These ports were closed: 

21  ftp Timeout 0 ms

Furthermore, I can add other open ports, such as IMAP and POP3, and they show as open once I edit the router firewall. No matter how many times I delete and add FTP Server, port 21 never shows as open on mxtoolbox.com, and of course the customer cannot reach the FTP site. He can successfully reach my locally-hosted webpage.

Improve this question

3 Answers 3

Reset to default
6

From the remote site, you can use traceroute to work out where in the path the port is blocked. Note that this has to be a *nix traceroute, eg linux, as Windows does not support traceroute over arbitrary ports.

Compare

sudo traceroute -p 21 -T <your server ip>

to 

sudo traceroute -p 80 -T <your server ip>

These have to be run as root as it requires elevated privileges.

Note that it is the IP after the last successful hop that tells you where the block is - ie, the hop that does not respond. So look for the next hop in the port 80 traceroute after the last successful one in the port 21 traceroute.

Improve this answer
3
  • Do you know of any websites set up to do this for a visitor? Such as mxtoolbox.com checks MX issues, and canyouseeme.org checks for open ports, a site that does a trace route and displays the results would be very useful here. (I don't have control over the remote customer box and he's not technical)
    – Robert Kerr
    Nov 17, 2011 at 5:30
  • 1
    I have never heard of any that would do something like this. Do you have no one you know that has a linux box? If you like I can test it. In my profile is my website, and there is contact form you can send me the IP address if you don't want to publish it here.
    – Paul
    Nov 17, 2011 at 6:01
  • Here's a site which does offer an online traceroute of TCP ports: websitepulse.com/tools/tcp-traceroute-test
    – bsplosion
    Mar 20, 2020 at 21:19
1

To check at which point or hop your port is being blocked use tracetcp. its very simple as below.

To check port 31 all the way to destination:

$ tracetcp www.ebay.co.uk:31

Tracing route to 66.135.192.41 [www.ebay.co.uk] on port 31


Over a maximum of 30 hops.

1       1 ms    1 ms    1 ms    192.168.0.1     [wintermute]

2       10 ms   13 ms   9 ms    10.78.128.1

3       *       *       *       Request timed out.

4       *       *       *       Request timed out.

5       *       *       *       Request timed out.

6 ... continues until maximum number of hops reached.

you just need to install winpcap than this utility will work from Windows Cmd.

http://simulatedsimian.github.io/tracetcp_examples.html#scan-for-blocked-outgoing-ports

Improve this answer
0

If you don't have access to a Linux box, just install the telnet client on Windows:

Control Panel -> Programs and Features

telnet server-ip port

Or you can download PuTTY.

If the conenction timesout or is refused, then that is a problem :)

Improve this answer
1
  • He's looking for the firewall between the client and server because he knows that he's not able to connect directly to the port. So a connection directly to the port doesn't reveal any new information. Hope that explains why someone probably gave you a negative one. I just bumped it up to zero because you didn't do anything wrong except misunderstand the OP request.
    – jbrahy
    2 days ago

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .