Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to tell the difference between my ISP blocking traffic on certain ports and my NAT router/firewall blocking that traffic? The sites “Shields Up” and “Can you see me” show my ports closed or not accessible, but I assume that is primarily due to the NAT router. (Obviously, I could just remove the router, connect directly and use those sites, but is there a simple way to test without doing that?)

share|improve this question
up vote 1 down vote accepted

You can set your computer as the DMZ in the router configuration, which means that NAT essentially passes everything to you.

share|improve this answer is able to tell you whether any of the 65535 UDP or TCP ports are being blocked between your client machine and the Internet. They have a Java Applet client that sends packets back and forth from your machine to their server over the port(s) of your choosing, and if the packets transfer successfully, you know the port isn't blocked by any intervening firewall (such as your own home router or your ISPs firewall.)

So in your case you could first run tests from behind your router and get a list of all blocked ports. Then you could connect your machine directly to the Internet (bypassing the firewall) and run the tests again. By comparing the results you'd be able to figure out the difference between what your home router blocks and what your ISP blocks.

It's important to note that Firebind is NOT a port scanner. It's a "PATH" scanner.

share|improve this answer

You could set your router/firewall to do logging and see what it is blocking specifically.

share|improve this answer
Ah - turn on logging, run the Shields up port scan, and any port NOT logged is blocked somewhere else. Great idea. – Will M Jul 22 '09 at 16:19
But you wouldn't want to up-vote this question, would you? – innaM Jul 22 '09 at 16:37
Clever, but no - router (mine, anyway) logs a possible port scan and doesn't keep all the details, so I'm still looking for ideas. – Will M Jul 23 '09 at 3:20

This will take a lot of time but will get you the list of all blocked ports:


while [  $COUNTER -lt 65535 ]; do
        echo $COUNTER
        curl$COUNTER --connect-timeout 1
        let COUNTER=COUNTER+1
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .