Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I prove (with logging) where a port block is occurring?

I've set up an FTP site on IIS (windows 7 home) and set up a rule in the Windows Firewall allowing access. The ftp site is accessible via my local browser to my static IP (ftp.example.com, where DNS is godaddy, so its resolving to my static IP and the ftp directory is being served). I've also set up a rule in my uVerse router firewall allowing FTP Server access to this machine. However, my customer cannot reach my FTP site, and when I test using mxtoolbox.com ..

1 open ports:

80  http    Success 78 ms

These ports were closed:

21  ftp Timeout 0 ms

Furthermore, I can add other open ports, such as IMAP and POP3, and they show as open once I edit the router firewall. No matter how many times I delete and add FTP Server, port 21 never shows as open on mxtoolbox.com, and of course the customer cannot reach the FTP site. He can successfully reach my locally-hosted webpage.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

From the remote site, you can use traceroute to work out where in the path the port is blocked. Note that this has to be a *nix traceroute, eg linux, as Windows does not support traceroute over arbitrary ports.

Compare

sudo traceroute -p 21 -T <your server ip>

to

sudo traceroute -p 80 -T <your server ip>

These have to be run as root as it requires elevated privileges.

Note that it is the IP after the last successful hop that tells you where the block is - ie, the hop that does not respond. So look for the next hop in the port 80 traceroute after the last successful one in the port 21 traceroute.

share|improve this answer
    
Do you know of any websites set up to do this for a visitor? Such as mxtoolbox.com checks MX issues, and canyouseeme.org checks for open ports, a site that does a trace route and displays the results would be very useful here. (I don't have control over the remote customer box and he's not technical) –  Robert Kerr Nov 17 '11 at 5:30
1  
I have never heard of any that would do something like this. Do you have no one you know that has a linux box? If you like I can test it. In my profile is my website, and there is contact form you can send me the IP address if you don't want to publish it here. –  Paul Nov 17 '11 at 6:01
add comment

If you don't have access to a Linux box, just install the telnet client on Windows:

Control Panel -> Programs and Features

telnet server-ip port

Or you can download PuTTY.

If the conenction timesout or is refused, then that is a problem :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.