|
|
Our Hot Pick: Rising Antivirus 2006 - Certified by TUV & Checkmark! Get 10% discount by entering this coupon code: ONDISCOUNT10
Hello,
We sometimes find that an ISP is blocking/not passing some ports from the web to us. We normally just call the ISP and ask them if they are passing the specifiied ports on to us and they tell us.
Can we somehow test this ourselves? I see "PortDetective" from TZo.com but this just appears to show if the port is secure., not whether the ISP is blocking it.
Matt
|
|
you might try Shields Up at www.grc.com
-- Cris Hanna [SBS-MVP] ------------------------------------------------- Microsoft MVPs Independent Experts (MVPs do not work for MS) Real World Answers --------------------------------------------------------- Please do not contact me directly regarding issues
"Matt Landis" <matt(remove)[ at ]landiscomputer.com> wrote in message news:O3uLYL0tHHA.292[ at ]TK2MSFTNGP02.phx.gbl...
[Quoted Text] > Hello, > > We sometimes find that an ISP is blocking/not passing some ports from the > web to us. > We normally just call the ISP and ask them if they are passing the > specifiied ports on to us and they tell us. > > Can we somehow test this ourselves? > I see "PortDetective" from TZo.com but this just appears to show if the > port is secure., not whether the ISP is blocking it. > > Matt >
|
|
As is the case with most services you can Telnet to the port and if it's open you will connect. In this case you can from a Command Prompt:
Telnet myserver 3389
and if the machine "myserver" is there you will connect and get a blank screen or maybe a flashing curor, if there isn't a "myserver" or the port is not open you will get a failed connection message. This will work across the Internet as well by using the FQDN and one reason I say opening RDP to the world is just stupid as any script could plug away all day till it finds your server then run TSGrinder at it.
JamesB (SBSC, WCP)
"Cris Hanna [SBS-MVP]" <crisnospamhanna[ at ]computingnospampossibilities.net> wrote in message news:uOXDGu0tHHA.1060[ at ]TK2MSFTNGP06.phx.gbl...
[Quoted Text] > you might try Shields Up at www.grc.com > > > -- > Cris Hanna [SBS-MVP] > ------------------------------------------------- > Microsoft MVPs > Independent Experts (MVPs do not work for MS) > Real World Answers > --------------------------------------------------------- > Please do not contact me directly regarding issues > > "Matt Landis" <matt(remove)[ at ]landiscomputer.com> wrote in message > news:O3uLYL0tHHA.292[ at ]TK2MSFTNGP02.phx.gbl... >> Hello, >> >> We sometimes find that an ISP is blocking/not passing some ports from the >> web to us. >> We normally just call the ISP and ask them if they are passing the >> specifiied ports on to us and they tell us. >> >> Can we somehow test this ourselves? >> I see "PortDetective" from TZo.com but this just appears to show if the >> port is secure., not whether the ISP is blocking it. >> >> Matt >> > >
|
|
Cris,
We use grc.com to see if WE (or our firewall) is blocking the port. What I'm trying to find out is if the ISP is block the port.
Is that possible?
Matt
"Cris Hanna [SBS-MVP]" <crisnospamhanna[ at ]computingnospampossibilities.net> wrote in message news:uOXDGu0tHHA.1060[ at ]TK2MSFTNGP06.phx.gbl...
[Quoted Text] > you might try Shields Up at www.grc.com > > > -- > Cris Hanna [SBS-MVP] > ------------------------------------------------- > Microsoft MVPs > Independent Experts (MVPs do not work for MS) > Real World Answers > --------------------------------------------------------- > Please do not contact me directly regarding issues > > "Matt Landis" <matt(remove)[ at ]landiscomputer.com> wrote in message > news:O3uLYL0tHHA.292[ at ]TK2MSFTNGP02.phx.gbl... >> Hello, >> >> We sometimes find that an ISP is blocking/not passing some ports from the >> web to us. >> We normally just call the ISP and ask them if they are passing the >> specifiied ports on to us and they tell us. >> >> Can we somehow test this ourselves? >> I see "PortDetective" from TZo.com but this just appears to show if the >> port is secure., not whether the ISP is blocking it. >> >> Matt >> > >
|
|
Matt Landis wrote:
[Quoted Text] > Cris, > > We use grc.com to see if WE (or our firewall) is blocking the port. > What I'm trying to find out is if the ISP is block the port. >
Trivial if you have (or can borrow) a router with logging. A bit harder if you can't, you can only infer what's going on. But if you forward 3389 to SBS and you still can't connect to it, then probably the ISP is blocking it. You can also do this with a port that SBS doesn't normally listen on by using Network Monitor to look for a connection attempt.
The Netgear DG834 isn't amazingly reliable, I had to reboot one this morning, but the logging is good and it's probably cheap enough to have one laying around to help troubleshoot this kind of problem.
|
|
I've never had an experience of an ISP blocking 3389. But I guess there's always a first.
-- Kevin Weilbacher [SBS-MVP] "The days pass by so quickly now, the nights are seldom long"
"Matt Landis" <matt(remove)[ at ]landiscomputer.com> wrote in message news:O3uLYL0tHHA.292[ at ]TK2MSFTNGP02.phx.gbl...
[Quoted Text] > Hello, > > We sometimes find that an ISP is blocking/not passing some ports from the > web to us. > We normally just call the ISP and ask them if they are passing the > specifiied ports on to us and they tell us. > > Can we somehow test this ourselves? > I see "PortDetective" from TZo.com but this just appears to show if the > port is secure., not whether the ISP is blocking it. > > Matt >
|
|
There are all sorts of port scanners NMAP (Microsoft has a nice port of it), Angry IP Scanner can do this in principle. However my question is why are you asking about testing port 3389? If you are trying to get Terminal Services through the internet on a VPN then there are other ports involved too:
25 Email 80 Web Services 443 https 444 Sharepoint 1723 VPN 3389 Terminal services 4125 RWW
I agree with the previous postings that 3389 is rarely if ever blocked. Usually only SMTP and sometimes port 80 are at issue.
Sorry if I am off base here, its just a thought that might help.
Paul "Matt Landis" wrote:
[Quoted Text] > Hello, > > We sometimes find that an ISP is blocking/not passing some ports from the > web to us. > We normally just call the ISP and ask them if they are passing the > specifiied ports on to us and they tell us. > > Can we somehow test this ourselves? > I see "PortDetective" from TZo.com but this just appears to show if the port > is secure., not whether the ISP is blocking it. > > Matt > > >
|
|
Paul (and everyone ;-)
It seems people responding are getting sidetracked by my using 3389 as an example, but I just used that as an example. (as noted in the subject) Sorry to be unclear.
What I REALLY am after is a way to see if the ISP is blocking SOME specific port. I know how to test if my router/firewall is blocking.
Any ideas on how to see if the ISP is blocking one or more ports? Thanks! Matt
"Paul Wolfson" <PaulWolfson[ at ]discussions.microsoft.com> wrote in message news:5A56498F-24BD-4CED-82F1-D859E7C03540[ at ]microsoft.com...
[Quoted Text] > There are all sorts of port scanners NMAP (Microsoft has a nice port of > it), > Angry IP Scanner can do this in principle. However my question is why are > you asking about testing port 3389? If you are trying to get Terminal > Services through the internet on a VPN then there are other ports involved > too: > > 25 Email > 80 Web Services > 443 https > 444 Sharepoint > 1723 VPN > 3389 Terminal services > 4125 RWW > > I agree with the previous postings that 3389 is rarely if ever blocked. > Usually only SMTP and sometimes port 80 are at issue. > > Sorry if I am off base here, its just a thought that might help. > > Paul > "Matt Landis" wrote: > >> Hello, >> >> We sometimes find that an ISP is blocking/not passing some ports from the >> web to us. >> We normally just call the ISP and ask them if they are passing the >> specifiied ports on to us and they tell us. >> >> Can we somehow test this ourselves? >> I see "PortDetective" from TZo.com but this just appears to show if the >> port >> is secure., not whether the ISP is blocking it. >> >> Matt >> >> >>
|
|
Matt Landis wrote:
[Quoted Text] > Paul (and everyone ;-) > > It seems people responding are getting sidetracked by my using 3389 as an > example, but I just used that as an example. (as noted in the subject) > Sorry to be unclear. > > What I REALLY am after is a way to see if the ISP is blocking SOME specific > port. I know how to test if my router/firewall is blocking. > > Any ideas on how to see if the ISP is blocking one or more ports? > Thanks!
Yes. As I said last night, you buy or borrow a cheap router with logging, if your existing one doesn't, and get that nice Mr Gibson at grc.com to poke away at whatever port(s) you're worried about.
If nothing comes through, (check a port you know is OK to confirm everything's set up right) then it is a very good bet that the ISP is blocking it and you can ask why. It is entirely possible it was done accidentally, when another user asked for it to be blocked and someone made a typo. When you get something to work, you don't always remember all the things you did that didn't make it work in order to undo them.
|
|
Matt -
Thank you for the clarification. While I do not have a general solution to your problem, as I said I use two tools "Angry IP Scanner" which is easy to use and scans port (Google or see Sourceforge) for it and various NMAP ports (more a security hacking tool).
1. Use a port probing tool on the intranet side of your network and make sure the server responds on ports you want. Often this requires much more than a simple ping. 2. Assuming you can verify functionality on a particular port inside your firewall/router then you can look from the outside inward. Usually I try to remove the firewall/router completely or place the server in the firewall/router DMZ. Or place the server on a direct connection to the internet. 3. Now knowing that the server responds on say ports 443, 444 and 3389 on the intranet and that firewall/router is ruled out as a blocking mechanism, retry the port mapping. Usually I do this by RDP from the site through a server in my office and come back through from my router back into the site being tested. I know this sounds convoluted, but I can do it without leaving my chair. 4. Usually at this point it is pretty obvious that either I can see the same ports from the internet or not. Assuming I can, then my port forwarding rules on my firewall/router are wrong or the router just isn't sophisticated enough to do the job.
I can tell you from experience with SMTP forwarding and setting up VPNs, it is usually my errors or the firewall router, not the ISP - they have too much traffic to monitor every packet on their network.
I hope this helps. Good luck.
Paul
"Matt Landis" wrote:
[Quoted Text] > Paul (and everyone ;-) > > It seems people responding are getting sidetracked by my using 3389 as an > example, but I just used that as an example. (as noted in the subject) > Sorry to be unclear. > > What I REALLY am after is a way to see if the ISP is blocking SOME specific > port. I know how to test if my router/firewall is blocking. > > Any ideas on how to see if the ISP is blocking one or more ports? > Thanks! > Matt > > "Paul Wolfson" <PaulWolfson[ at ]discussions.microsoft.com> wrote in message > news:5A56498F-24BD-4CED-82F1-D859E7C03540[ at ]microsoft.com... > > There are all sorts of port scanners NMAP (Microsoft has a nice port of > > it), > > Angry IP Scanner can do this in principle. However my question is why are > > you asking about testing port 3389? If you are trying to get Terminal > > Services through the internet on a VPN then there are other ports involved > > too: > > > > 25 Email > > 80 Web Services > > 443 https > > 444 Sharepoint > > 1723 VPN > > 3389 Terminal services > > 4125 RWW > > > > I agree with the previous postings that 3389 is rarely if ever blocked. > > Usually only SMTP and sometimes port 80 are at issue. > > > > Sorry if I am off base here, its just a thought that might help. > > > > Paul > > "Matt Landis" wrote: > > > >> Hello, > >> > >> We sometimes find that an ISP is blocking/not passing some ports from the > >> web to us. > >> We normally just call the ISP and ask them if they are passing the > >> specifiied ports on to us and they tell us. > >> > >> Can we somehow test this ourselves? > >> I see "PortDetective" from TZo.com but this just appears to show if the > >> port > >> is secure., not whether the ISP is blocking it. > >> > >> Matt > >> > >> > >> > > >
|
|
Paul,
Thanks for that thorough answer. The answer is what i thought it was... i was hoping for some wiz app that just tells me! ;-) (lazy me!)
Thanks! Matt
"Paul Wolfson" <PaulWolfson[ at ]discussions.microsoft.com> wrote in message news:980150F1-52BF-466E-A97D-73A411175609[ at ]microsoft.com...
[Quoted Text] > Matt - > > Thank you for the clarification. While I do not have a general solution > to > your problem, as I said I use two tools "Angry IP Scanner" which is easy > to > use and scans port (Google or see Sourceforge) for it and various NMAP > ports > (more a security hacking tool). > > 1. Use a port probing tool on the intranet side of your network and make > sure the server responds on ports you want. Often this requires much more > than a simple ping. > 2. Assuming you can verify functionality on a particular port inside your > firewall/router then you can look from the outside inward. Usually I try > to > remove the firewall/router completely or place the server in the > firewall/router DMZ. Or place the server on a direct connection to the > internet. > 3. Now knowing that the server responds on say ports 443, 444 and 3389 on > the intranet and that firewall/router is ruled out as a blocking > mechanism, > retry the port mapping. Usually I do this by RDP from the site through a > server in my office and come back through from my router back into the > site > being tested. I know this sounds convoluted, but I can do it without > leaving > my chair. > 4. Usually at this point it is pretty obvious that either I can see the > same ports from the internet or not. Assuming I can, then my port > forwarding > rules on my firewall/router are wrong or the router just isn't > sophisticated > enough to do the job. > > I can tell you from experience with SMTP forwarding and setting up VPNs, > it > is usually my errors or the firewall router, not the ISP - they have too > much > traffic to monitor every packet on their network. > > I hope this helps. Good luck. > > Paul > > "Matt Landis" wrote: > >> Paul (and everyone ;-) >> >> It seems people responding are getting sidetracked by my using 3389 as an >> example, but I just used that as an example. (as noted in the subject) >> Sorry to be unclear. >> >> What I REALLY am after is a way to see if the ISP is blocking SOME >> specific >> port. I know how to test if my router/firewall is blocking. >> >> Any ideas on how to see if the ISP is blocking one or more ports? >> Thanks! >> Matt >> >> "Paul Wolfson" <PaulWolfson[ at ]discussions.microsoft.com> wrote in message >> news:5A56498F-24BD-4CED-82F1-D859E7C03540[ at ]microsoft.com... >> > There are all sorts of port scanners NMAP (Microsoft has a nice port of >> > it), >> > Angry IP Scanner can do this in principle. However my question is why >> > are >> > you asking about testing port 3389? If you are trying to get Terminal >> > Services through the internet on a VPN then there are other ports >> > involved >> > too: >> > >> > 25 Email >> > 80 Web Services >> > 443 https >> > 444 Sharepoint >> > 1723 VPN >> > 3389 Terminal services >> > 4125 RWW >> > >> > I agree with the previous postings that 3389 is rarely if ever blocked. >> > Usually only SMTP and sometimes port 80 are at issue. >> > >> > Sorry if I am off base here, its just a thought that might help. >> > >> > Paul >> > "Matt Landis" wrote: >> > >> >> Hello, >> >> >> >> We sometimes find that an ISP is blocking/not passing some ports from >> >> the >> >> web to us. >> >> We normally just call the ISP and ask them if they are passing the >> >> specifiied ports on to us and they tell us. >> >> >> >> Can we somehow test this ourselves? >> >> I see "PortDetective" from TZo.com but this just appears to show if >> >> the >> >> port >> >> is secure., not whether the ISP is blocking it. >> >> >> >> Matt >> >> >> >> >> >> >> >> >>
|
|
On Jun 26, 12:39 pm, "Matt Landis" <matt(remove)[ at ]landiscomputer.com> wrote:
[Quoted Text] > Paul, > > Thanks for that thorough answer. > The answer is what i thought it was... i was hoping for some wiz app that > just tells me! ;-) (lazy me!) > > Thanks! > Matt > > "Paul Wolfson" <PaulWolf...[ at ]discussions.microsoft.com> wrote in message > > news:980150F1-52BF-466E-A97D-73A411175609[ at ]microsoft.com... > > > Matt - > > > Thank you for the clarification. While I do not have a general solution > > to > > your problem, as I said I use two tools "Angry IP Scanner" which is easy > > to > > use and scans port (Google or see Sourceforge) for it and various NMAP > > ports > > (more a security hacking tool). > > > 1. Use a port probing tool on the intranet side of your network and make > > sure the server responds on ports you want. Often this requires much more > > than a simple ping. > > 2. Assuming you can verify functionality on a particular port inside your > > firewall/router then you can look from the outside inward. Usually I try > > to > > remove the firewall/router completely or place the server in the > > firewall/router DMZ. Or place the server on a direct connection to the > > internet. > > 3. Now knowing that the server responds on say ports 443, 444 and 3389 on > > the intranet and that firewall/router is ruled out as a blocking > > mechanism, > > retry the port mapping. Usually I do this by RDP from the site through a > > server in my office and come back through from my router back into the > > site > > being tested. I know this sounds convoluted, but I can do it without > > leaving > > my chair. > > 4. Usually at this point it is pretty obvious that either I can see the > > same ports from the internet or not. Assuming I can, then my port > > forwarding > > rules on my firewall/router are wrong or the router just isn't > > sophisticated > > enough to do the job. > > > I can tell you from experience with SMTP forwarding and setting up VPNs, > > it > > is usually my errors or the firewall router, not the ISP - they have too > > much > > traffic to monitor every packet on their network. > > > I hope this helps. Good luck. > > > Paul > > > "Matt Landis" wrote: > > >> Paul (and everyone ;-) > > >> It seems people responding are getting sidetracked by my using 3389 as an > >> example, but I just used that as an example. (as noted in the subject) > >> Sorry to be unclear. > > >> What I REALLY am after is a way to see if the ISP is blocking SOME > >> specific > >> port. I know how to test if my router/firewall is blocking. > > >> Any ideas on how to see if the ISP is blocking one or more ports? > >> Thanks! > >> Matt > > >> "Paul Wolfson" <PaulWolf...[ at ]discussions.microsoft.com> wrote in message > >>news:5A56498F-24BD-4CED-82F1-D859E7C03540[ at ]microsoft.com... > >> > There are all sorts of port scanners NMAP (Microsoft has a nice port of > >> > it), > >> > Angry IP Scanner can do this in principle. However my question is why > >> > are > >> > you asking about testing port 3389? If you are trying to get Terminal > >> > Services through the internet on a VPN then there are other ports > >> > involved > >> > too: > > >> > 25 Email > >> > 80 Web Services > >> > 443 https > >> > 444 Sharepoint > >> > 1723 VPN > >> > 3389 Terminal services > >> > 4125 RWW > > >> > I agree with the previous postings that 3389 is rarely if ever blocked. > >> > Usually only SMTP and sometimes port 80 are at issue. > > >> > Sorry if I am off base here, its just a thought that might help. > > >> > Paul > >> > "Matt Landis" wrote: > > >> >> Hello, > > >> >> We sometimes find that an ISP is blocking/not passing some ports from > >> >> the > >> >> web to us. > >> >> We normally just call the ISP and ask them if they are passing the > >> >> specifiied ports on to us and they tell us. > > >> >> Can we somehow test this ourselves? > >> >> I see "PortDetective" from TZo.com but this just appears to show if > >> >> the > >> >> port > >> >> is secure., not whether the ISP is blocking it. > > >> >> Matt
Matt,
We developed Portdetective.com, just to clarify the way that it works is it will open a connection on the port that you want to test and then send a message to our servers to send a message to that port.
If the message does not come in a certain amount of time, we can assume that the port is blocked. Blocked being two things, the ISP is blocking the port or the port is not opened correctly in the router and forwarding the message to the internal server that is listening for the message.
Hope this helps
|
|
Mike,
Ok, then to summarize this conversation:
To determine if an ISP is blocking a port:
-in firewall, forward the port to a pc inside the network -run portdetective.com -if it is blocked, very likely the ISP is blocking it.
Accurate? Matt
"Mick" <mdfoley[ at ]gmail.com> wrote in message news:1182957676.895892.140810[ at ]c77g2000hse.googlegroups.com...
[Quoted Text] > On Jun 26, 12:39 pm, "Matt Landis" <matt(remove)[ at ]landiscomputer.com> > wrote: >> Paul, >> >> Thanks for that thorough answer. >> The answer is what i thought it was... i was hoping for some wiz app that >> just tells me! ;-) (lazy me!) >> >> Thanks! >> Matt >> >> "Paul Wolfson" <PaulWolf...[ at ]discussions.microsoft.com> wrote in message >> >> news:980150F1-52BF-466E-A97D-73A411175609[ at ]microsoft.com... >> >> > Matt - >> >> > Thank you for the clarification. While I do not have a general >> > solution >> > to >> > your problem, as I said I use two tools "Angry IP Scanner" which is >> > easy >> > to >> > use and scans port (Google or see Sourceforge) for it and various NMAP >> > ports >> > (more a security hacking tool). >> >> > 1. Use a port probing tool on the intranet side of your network and >> > make >> > sure the server responds on ports you want. Often this requires much >> > more >> > than a simple ping. >> > 2. Assuming you can verify functionality on a particular port inside >> > your >> > firewall/router then you can look from the outside inward. Usually I >> > try >> > to >> > remove the firewall/router completely or place the server in the >> > firewall/router DMZ. Or place the server on a direct connection to the >> > internet. >> > 3. Now knowing that the server responds on say ports 443, 444 and 3389 >> > on >> > the intranet and that firewall/router is ruled out as a blocking >> > mechanism, >> > retry the port mapping. Usually I do this by RDP from the site through >> > a >> > server in my office and come back through from my router back into the >> > site >> > being tested. I know this sounds convoluted, but I can do it without >> > leaving >> > my chair. >> > 4. Usually at this point it is pretty obvious that either I can see >> > the >> > same ports from the internet or not. Assuming I can, then my port >> > forwarding >> > rules on my firewall/router are wrong or the router just isn't >> > sophisticated >> > enough to do the job. >> >> > I can tell you from experience with SMTP forwarding and setting up >> > VPNs, >> > it >> > is usually my errors or the firewall router, not the ISP - they have >> > too >> > much >> > traffic to monitor every packet on their network. >> >> > I hope this helps. Good luck. >> >> > Paul >> >> > "Matt Landis" wrote: >> >> >> Paul (and everyone ;-) >> >> >> It seems people responding are getting sidetracked by my using 3389 as >> >> an >> >> example, but I just used that as an example. (as noted in the subject) >> >> Sorry to be unclear. >> >> >> What I REALLY am after is a way to see if the ISP is blocking SOME >> >> specific >> >> port. I know how to test if my router/firewall is blocking. >> >> >> Any ideas on how to see if the ISP is blocking one or more ports? >> >> Thanks! >> >> Matt >> >> >> "Paul Wolfson" <PaulWolf...[ at ]discussions.microsoft.com> wrote in >> >> message >> >>news:5A56498F-24BD-4CED-82F1-D859E7C03540[ at ]microsoft.com... >> >> > There are all sorts of port scanners NMAP (Microsoft has a nice port >> >> > of >> >> > it), >> >> > Angry IP Scanner can do this in principle. However my question is >> >> > why >> >> > are >> >> > you asking about testing port 3389? If you are trying to get >> >> > Terminal >> >> > Services through the internet on a VPN then there are other ports >> >> > involved >> >> > too: >> >> >> > 25 Email >> >> > 80 Web Services >> >> > 443 https >> >> > 444 Sharepoint >> >> > 1723 VPN >> >> > 3389 Terminal services >> >> > 4125 RWW >> >> >> > I agree with the previous postings that 3389 is rarely if ever >> >> > blocked. >> >> > Usually only SMTP and sometimes port 80 are at issue. >> >> >> > Sorry if I am off base here, its just a thought that might help. >> >> >> > Paul >> >> > "Matt Landis" wrote: >> >> >> >> Hello, >> >> >> >> We sometimes find that an ISP is blocking/not passing some ports >> >> >> from >> >> >> the >> >> >> web to us. >> >> >> We normally just call the ISP and ask them if they are passing the >> >> >> specifiied ports on to us and they tell us. >> >> >> >> Can we somehow test this ourselves? >> >> >> I see "PortDetective" from TZo.com but this just appears to show if >> >> >> the >> >> >> port >> >> >> is secure., not whether the ISP is blocking it. >> >> >> >> Matt > > Matt, > > We developed Portdetective.com, just to clarify the way that it works > is it will open a connection on the port that you want to test and > then send a message to our servers to send a message to that port. > > If the message does not come in a certain amount of time, we can > assume that the port is blocked. Blocked being two things, the ISP is > blocking the port or the port is not opened correctly in the router > and forwarding the message to the internal server that is listening > for the message. > > Hope this helps > >
|
|
|