How to interpret Open | Filtered status of port scan?

Question

I have Softether VPN server running on Windows 10 PC. My ISP offers me CGNAT (IP4) and GUA (IP6). I have configured it to accept L2TP Ipsec with preshared key.

Now I am checking the open port status using https://www.ipvoid.com/udp-port-scan/ for my IPv6 GUA

Port 500 is open on my IPv6 GUA.

However 4500 returns Open | Filtered.

What should I interpret out of that status Open|Filtered.

I have read https://nmap.org/book/man-port-scanning-basics.html

open|filtered

Nmap places ports in this state when it is unable to determine whether a port is open or filtered. This occurs for scan types in which open ports give no response. The lack of response could also mean that a packet filter dropped the probe or any response it elicited. So Nmap does not know for sure whether the port is open or being filtered. The UDP, IP protocol, FIN, NULL, and Xmas scans classify ports this way.

However due to my lack of networking knowledge I did not get much idea.

Asking ISP if they block UDP 4500 will not yield meaningful responses as it's hard to find the right person who manages the firewall. Customer care (point of contact) is only going do guesswork

Can someone help me interpret this result in layman terms. Thanks.

Answer 1

Unlike with TCP, there is no explicit connection establishment in UDP. The only way to probe a UDP port is to directly send some data to it, and then hope to receive some sort of response... or not.

In TCP, communications always start with a generic "open connection" packet (TCP SYN) and the server's OS will always respond to it in the same way, no matter what kind of software is running on that port. This lets port-scanner tools have a definite answer on whether the port is "open" (SYN/ACK received) or "closed" (RST received) or "filtered" (nothing received at all).

But in UDP there is no such thing. If port 4500 is being used by a program that expects a valid IKE IPsec packet, but the port-scanner tool sends some generic garbage instead, your IKE server can simply choose to not reply to such a packet – and the scanner has no way to know whether the packet was received or not; all it knows is that there was no reply to it.

The only way to reliably know whether the port is "open" is to check on the receiving side, i.e. on your Windows IPsec server – run a packet capture tool such as Wireshark on udp port 4500 and check whether it is showing any packets being received from the port-test tool. If Wireshark shows inbound packets, then the port is "open" all the way to the PC (that is, while the computer's firewall may still be an issue, seeing the packets means they were not filtered by the ISP).

Answer 2

The SoftEther VPN Server Specification includes this :

L2TP/IPsec Sever Function Specifications on SoftEther VPN Server

• User-authentication Methods: PAP and MS-CHAPv2
• NAT-Traversal: RFC3947 IPsec over UDP Encapsulation
• Transport UDP Ports: UDP 500 and 4500 (Allow both ports on the firewall. Add UDP port forwarding for both 500 & 4500 on the NAT.)

It's most likely that the SoftEther VPN Server has opened this port on your computer.

So don't worry - this is entirely normal.