nmap: which ports are visible from outside

nmap sends packets to a machine's ports and sorts the ports by the answers into open, closed and filtered. ss -tlnp on the machine itself shows what listens; nmap from another machine shows what can be reached through the firewall. Together they give the attack surface.

A scan of the lab machine 192.0.2.1 from the lab-outside network namespace — a "stranger's machine" on the same VM:

student@ubuntu:~$ sudo ip netns exec lab-outside \
> nmap -p 22,80,5432,8080 192.0.2.1
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-10-21 05:35 UTC
Nmap scan report for 192.0.2.1
Host is up (0.000022s latency).
PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   open   http
5432/tcp closed postgresql
8080/tcp open   http-proxy
MAC Address: 22:C9:B6:56:61:18 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 13.09 seconds

Without -p it checks the 1000 most common ports and folds the rest into Not shown: 997 closed tcp ports (reset).

nmap spent 13 seconds of this scan waiting for DNS: in the lab-outside namespace /etc/resolv.conf points to 127.0.0.53, and that address does not exist there. With -n (no name lookups) the same scan takes 0.09 seconds.

States

--reason tells which answer decided the state. Here port 8080 is closed by the rule tcp dport 8080 drop, 8081 by reject with tcp reset:

PORT     STATE    SERVICE         REASON
22/tcp   open     ssh             syn-ack ttl 64
8080/tcp filtered http-proxy      no-response
8081/tcp closed   blackice-icecap reset ttl 64

The SERVICE column is just the port's name from nmap's list: there is no blackice-icecap on 8081. -sV shows which program really answers:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.20
  (Ubuntu Linux; protocol 2.0)
80/tcp open  http    nginx 1.24.0 (Ubuntu)

UDP often gives no answer at all, and nmap reports such a port as open|filtered; it is closed when an ICMP "port unreachable" arrives.

How nmap scans

Raw packets require root. student without sudo gets:

student@ubuntu:~$ nmap -sS -p 22 127.0.0.1
You requested a scan type which requires root privileges.
QUITTING!

Before the scan nmap checks whether the host is alive: in its own subnet by ARP (Host is up, received arp-response), further away by ping and probes to 80 and 443. A host that stays silent is skipped:

Note: Host seems down. If it is really up, but blocking our ping
  probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 1.46 seconds

-Pn scans the ports without that check.

Outside and inside

Scanning a machine from itself goes through the lo interface, and a firewall usually lets lo through entirely. A port closed by a drop policy looks open from inside. Test the firewall from another machine or a separate network namespace — more in firewall.

• ss — what listens on the machine itself.
• firewall — nftables and closing ports.
• nc — check one port without nmap.
• network-diagnostics — ping, traceroute and other network checks.
• ip — addresses and network namespaces.