Saturday, October 16, 2021

A question about nmap and egress traffic

In another sub we are talking about egress traffic on port 25 in Oracle Cloud Infrastructure instances. I suggested to check if this traffic is allowed by running the following test:

telnet in-v3.mailjet.com 25 

OP told me that they ran the following test, with success, showing that egress traffic on port 25 is allowed:

nmap -p 25 in-v3.mailjet.com 25 

My first reaction was to say that this test proves that the other server, the remote, allows ingress traffic on port 25, and that's not what we are looking for. But is it right? I have no idea how nmap works. Does the successful "Host is up" result imply that local egress traffic on port 25 is also open?

Running both in my own OCI instance, the telnet test fails and the nmap test shows "Host is up". Running the telnet test from another location, I can successfully connect to the same remote server.

Originally we were using other remote servers, but I put the MailJet here for consistency. I also tried another remote server with the same results: they can allow telnet on port 25 because I also tested from another location, telnet fails for both from OCI, nmap works for both on OCI.

P.S.: I forgot to mention: the following works from the OCI instance, if it makes any difference:

telnet in-v3.mailjet.com 587 


No comments:

Post a Comment