Printable View
I'm looking for a program that will test my outbound connection for every port. I'm running a Nat Firewall and I pretty sure all outbound connection pass without problem but I want to be sure. I know their a few leak test out there but they test software firewall. I need one who test hardware firewall. Thank you.
Let someone Nmap you ;)
I don't need someone to test my inbound firewall. I need a program to test my OUTBOUND firewall..
I'm thinking your ACL's will give you a good idea as to what is blocked and what's not. Most firewalls by default allow everything out, nothing in. Using Nmap from the inside my give you what you want.
http://grc.com/lt/leaktest.htm
This may solve your problem.
grc leaktest sucks arse and it doen't work. There is a program called firehole (I think) that works better.
find someone on the outside that will let you nmap them...that will work just as well.
I dont think NMAP will work in this case if I userstand what the problem is.
NMAP will scan all the ports on the target computer but the client will still only use a few ports on the host machine and not test all outbound ports like he wants.
well, does he want to test if it will connect to a certain outbound port, or if it will connect from a certain internal port? I guess thats the real question. If he is looking to outbound ports, nmap will work. If he is looking from certain internal ports...then I really have no idea unless you write your own program to do it.
SDK: I think you need someone to help you determine what ports your firewall will allow you internal machines to connect to on a remote machine.... Your firewall's egress rules..... It'll probably be a lot.....
What you need to do is have someone with a good firewall, well logged, that will allow you to use a scanner that can be configured to scan every port available, there's a million of those out there..... Then that person can send you the log of the scan and you can see what went out. The scan should be a plain SYN scan so the remote will definitely pick it up.
Another option is to give someone your IP address that you will appear to scan from that runs a Snort box outside the firewall and have then implement a rule as follows:-
alert tcp xxx.xxx.xxx.xxx any -> any any (msg; "Bills test": flags; S; classtype: bad-unknown:)
Where the xxx.xxx.xxx.xxx is your IP address.
The second option will actually work better IMO, since the logging on some firewalls will ignore a whole bunch of stuff unless the work is put in to log it.
Hope this helps
scrip it w/ netcat ... if you want help pm me
Google search for "hardware firewall leaktest "
Hope this helps
looking at my router config page under advanced and firewall it is set to
Allow Default LAN,* *,* IP (0),*
which I think allows all outbound traffic on all ports, which is probably what you have.
I don't know of a program to test this though. If you have something similar to what I have I'm sure you can change the settings to just allow on port 80 or whatever you are looking for.
Thank for all info.. I'll look into it.. A quick question for all you, I'm not a expert in network protocol but if I scan the ports X outside on a IP address like www.microsoft.com will the packet use that port X to go throw my firewall? Ex : Pinging port 7393 on microsoft.com will be outbound as port 7993 on my firewall?
What I realy want is to block all program to be block when they try to access the net from except for port 21 and 80 with my firewall. Now, I think everythink is wide open. But I want to test it and be sure! :)
SDK: You can't ping a port. Ping is an ICMP function and as such doesn't have a port, though it reports port 0.
You need a scanner such as SuperScan to attempt the three way handshake, (or some part of it), on each port to see which ports are open outbound on your firewall.
I have a scanner... This is what I mean! Gulp! ;) Gonna edit my message!
I think that the outbound traffic picks a random port to use to connect to a set port on another machine. And the only time an outbound port is open is when your connected to a host. You should just be able to set a firewall rule to only allow outbound connections to port 80 and port 21. However, it would still use some other port on your machine to connect to the set port on the other machine. For example, right now I'm connected to this site on port 80, but the local port used is 58309. I don't think any scanner would show a leak unless you were actually connected to someone using a port. Either that or it would show a leak on every port.
I have look at Fatphantom google address and I found nothing except software leaktest! :( I'll continue searching.
Theres no way you can do this with a scanner(NMAP or aything) your trying to test all your outbound ports. The scanner program will choose random ports on your machine and probably only a few. Having someone scan you is pointless. All this will test is your incoming ports.
Etruscan is right use netcat. With netcat you can specify your out going port.
ie.
nc -p 100 192.168.1.1 80
This will use you outbound port 100 bascially what you need is a script that does something like this
for(x=0;x<65536;x++)
nc -p <x> some_ip some_port
I would choose a machine that you can get the banner back from connecting the each time through the loops see if you get the banner. If you do that outbound port works if not then you got a probelm with that port or it may have already been in use and you should check again.
What do you suggest for service? I being trying a few port but I cannot get a single service to answer me and close nc alone. I always have to enter quit to quit the service.. (Mail, ftp, etc)
Edit : I found a service, the daytime service on port 13. :)
I just created myself a quick VB utilites.. Kind of sluggish but very slow but it work on calling a batch file with 2 parametters. One for the port to test and one for the file to test result. I call nc to ping a time server with a increasing outbound port. nyone interest in having it can send me a pm.