Does a nmap scan against my own IP go past the firewall?

Question

I'm trying to secure my computer against local network attacks for when I'm at university or a LAN party.

Does running a nmap scan against my own IP go through the firewall or does it bypass the firewall?

Answer 1

The packets always pass the client firewall, but gets routed on your computer (these packets do not go outside the machine).

You can confirm it by using a packet sniffer like Wireshark or iptables. Using iptables:

1. Temporary flush (remove) all firewall rules: sudo iptables -F

2. Add an rule for capturing local traffic (traffic that comes from the loopback adapter):

   sudo iptables -A INPUT -i lo -j ACCEPT
   

3. Watch the number of packets hitting the rule:

   sudo watch -n1 iptables -vnL
   

4. Open a new terminal window and test whether the packets go outside or not:

   nmap [your-network-ip]
   

5. Check the command from #3, you'll see like 2000 hits (first column)
6. (optional) test for an other IP, e.g. nmap 8.8.8.8. No packets will be caught by the rule from #2.

Answer 2

if you run it from the same machine as your scanning, no - it doesn't leave your machine. It does hit your local firewall rules though. This applies for both localhost interfaces and your Network card IPs.