Hello,
I have a complex NPF confiuration on a server and I don't understand
why ftp and rtsp ports are opened. From WAN, namp returns:Root riemann:[~] > nmap -4 legendre.systella.fr Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-20 16:18 +0200 Nmap scan report for legendre.systella.fr (188.231.16.145) Host is up (0.059s latency). Other addresses for legendre.systella.fr (not scanned): 2a0a:1c84:1000:a00::3 Not shown: 995 filtered tcp ports (no-response) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 443/tcp open https 554/tcp open rtsp Nmap done: 1 IP address (1 host up) scanned in 6.34 seconds Root riemann:[~] > nmap -6 legendre.systella.fr Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-20 16:19 +0200 Nmap scan report for legendre.systella.fr (2a0a:1c84:1000:a00::3) Host is up (0.11s latency). Other addresses for legendre.systella.fr (not scanned): 188.231.16.145 Not shown: 995 filtered tcp ports (no-response) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 443/tcp open https 554/tcp open rtsp Nmap done: 1 IP address (1 host up) scanned in 27.92 seconds Root riemann:[~] Please not open status for TCP/21 and TCP/554. This server has a lot of network adapters: - bridge0 (wm0/wm1) 192.168.12.1/24 - WAN (wm2) 188.231.16.145/29, 2a0a:1c84:1000:a00::3/64 - lagg0 (wm3/wm4) 192.168.10.128/24, 2a0a:1c84:1000:a10::128/64 - DMZ (re0) 192.168.1.2/24, 2a0a:1c84:1000:a01::2/64 - VLAN15 192.168.15.128/24, 2a0a:1c84:1000:a15::128/64 - VLAN16 192.168.16.128/24, 2a0a:1c84:1000:a16::128/64 Server in DMZ has another WAN access. My npf.conf is: $lan_if = "lagg0" $wan_if = "wm2" $bacula_if = "wm1" $video_if = "wm0" $ext_v4 = inet4($wan_if) $dmz_if = "re0" $vlan15_if = "vlan15" $vlan16_if = "vlan16" set bpf.jit on; alg "icmp" # Redirection pour les torrents (avant le NAT !) #map $ext_v4 static 192.168.10.103 port 10241 <-> $ext_v4 port 10241 # Outgoing NAT map inet4($wan_if) dynamic 192.168.10.0/24 -> $ext_v4 map inet4($wan_if) dynamic 192.168.12.0/24 -> $ext_v4 map inet4($wan_if) dynamic 192.168.15.0/24 -> $ext_v4 map inet4($wan_if) dynamic 192.168.16.0/24 -> $ext_v4 procedure "log" { log: npflog0 } group "wan" on $wan_if { ruleset "blocklistd" # ICMP pass in final family inet4 proto icmp all pass out final family inet4 proto icmp all pass in final family inet6 proto ipv6-icmp all pass out final family inet6 proto ipv6-icmp all # ntp pass stateful out final family inet4 proto udp from $wan_if port ntp \ to any port ntp pass stateful in final family inet4 proto udp from $wan_if port ntp \ to any port ntp # ssh pass stateful out final family inet4 proto tcp from $wan_if \ to any port ssh pass stateful in final family inet4 proto tcp from any \ to $wan_if port ssh pass stateful out final family inet6 proto tcp from $wan_if \ to any port ssh pass stateful in final family inet6 proto tcp from any \ to $wan_if port ssh # ftp #pass stateful out final family inet4 proto tcp from $wan_if \ # to any port ftp # http/https pass stateful out final family inet4 proto tcp from $wan_if \ to any port http pass stateful out final family inet4 proto tcp from $wan_if \ to any port https pass stateful out final family inet4 proto tcp from $wan_if \ to any port 8080 pass stateful out final family inet6 proto tcp from any \ to any port http pass stateful out final family inet6 proto tcp from any \ to any port https # SVN pass stateful out final family inet4 proto tcp from $wan_if \ to any port svn # git pass stateful out final family inet4 proto tcp from $wan_if \ to any port git pass stateful out final family inet6 proto tcp from $wan_if \ to any port git # DNS pass stateful out final family inet4 from $wan_if to any port domain #pass stateful in final family inet4 from any to $wan_if port domain pass stateful out final family inet6 from $wan_if to any port domain # NAT pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port http pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port 8080 pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port https pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port ssh pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port imaps pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port pop3s pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port submission pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port smtp pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port ftp pass stateful out final family inet4 \ from 192.168.10.0/24 to any port ntp pass stateful out final family inet4 \ from 192.168.10.0/24 to any port nntp pass stateful out final family inet4 \ from 192.168.10.0/24 to any port git pass stateful out final family inet4 proto icmp \ from 192.168.10.0/24 pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port openvpn pass stateful out final family inet4 proto udp \ from 192.168.10.0/24 to any port openvpn pass stateful out final family inet4 proto tcp \ from 192.168.12.0/24 to any port https pass stateful out final family inet4 proto tcp \ from 192.168.15.0/24 to any port http pass stateful out final family inet4 proto tcp \ from 192.168.15.0/24 to any port https # PAS D'ACCES INTERNET POUR LE VLAN16 sauf pour la configuration # Le firmware passe en http ! pass stateful out final family inet4 proto tcp \ from 192.168.16.0/24 to any port http pass stateful out final family inet4 proto tcp \ from 192.168.16.0/24 to any port https pass stateful out final family inet4 proto tcp \ from 192.168.17.0/24 to any port http pass stateful out final family inet4 proto tcp \ from 192.168.17.0/24 to any port https # Video CNED pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to any port 8800 # VoIP over WIFI (Orange) pass stateful out final family inet4 proto udp \ from 192.168.10.104/32 to any port 500 pass stateful out final family inet4 proto udp \ from 192.168.10.104/32 to any port 4500 # port i2p sur hilbert pass stateful in final family inet4 from any to $wan_if port 10242 pass stateful out final family inet4 from 192.168.10.103 port 10242 to any pass stateful in final family inet6 from any to $wan_if port 10242 pass stateful out final family inet6 from \ 2a0a:1c84:1000:a10:d65d:64ff:feb4:9a3b port 10242 to any # ProtonVPN pass stateful in final family inet4 from any to $wan_if port 1194 pass stateful out final family inet4 from 192.168.10.103 port 1194 to any # domain sur hilbert pass stateful out final family inet4 \ from 192.168.10.103 to any port domain pass stateful out final family inet6 from \ 2a0a:1c84:1000:a10:d65d:64ff:feb4:9a3b to any port domain # mx2 pass stateful in final family inet4 proto tcp \ from any to $wan_if port smtp pass stateful in final family inet6 proto tcp \ from any to $wan_if port smtp # Actication Windows pass stateful out final family inet4 proto tcp from any to any port 1688 #pass stateful in final family inet4 proto tcp from any port 1688 to any # Wireguard VPN pass stateful out final family inet4 from any port 51825 to any pass stateful out final family inet6 from any port 51825 to any pass stateful out final family inet4 from 188.231.16.145 to 188.231.16.146 pass stateful in final family inet4 from 188.231.16.146 to 188.231.16.145 # Default block final all } group "lan" on $lan_if { pass final all } group "dmz" on $dmz_if { pass in final family inet4 proto icmp all pass out final family inet4 proto icmp all pass in final family inet6 proto ipv6-icmp all pass out final family inet6 proto ipv6-icmp all # ssh pass stateful out final family inet4 proto tcp from any \ to any port ssh pass stateful in final family inet4 proto tcp from any \ to any port ssh # git pass stateful out final family inet4 proto tcp from any \ to any port git pass stateful in final family inet4 proto tcp from any \ to any port git # rsync pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port rsync # DNS pass stateful out final family inet4 from any to any port domain pass stateful in final family inet4 from 192.168.1.1 to any \ port domain pass stateful in final family inet4 from 192.168.2.0/24 to any \ port domain # Greylist pass stateful in final family inet4 from any to 192.168.1.2 \ port 5252 pass stateful out final family inet4 from any to 192.168.1.1 \ port 5252 # http # https pass stateful in final family inet4 proto tcp from any \ to any port http pass stateful in final family inet4 proto tcp from any \ to any port https pass stateful out final family inet4 proto tcp from any \ to any port http pass stateful out final family inet4 proto tcp from any \ to any port https pass stateful out final family inet4 proto tcp from any \ to any port 8080 pass stateful out final family inet6 proto tcp from any \ to any port http pass stateful out final family inet6 proto tcp from any \ to any port https # solr pass stateful out final family inet4 proto tcp from any \ to any port 8983 # ntp pass stateful out final family inet4 proto udp from any \ to any port ntp # jitsi pass stateful out final family inet4 proto tcp \ from 192.168.10.0/24 to 192.168.1.1 port 4443 pass out final family inet4 proto udp \ from 192.168.10.0/24 to 192.168.1.1 port 10000 pass in final family inet4 proto udp \ from 192.168.1.1 port 10000 to 192.168.10.0/24 # VoIP pass out final family inet4 proto udp from 192.168.10.250 \ to 192.168.1.1 pass in final family inet4 proto udp from 192.168.1.1 \ to 192.168.10.250 pass out final family inet4 proto udp from 192.168.10.253 \ to 192.168.1.1 pass in final family inet4 proto udp from 192.168.1.1 \ to 192.168.10.253 # ESMTP pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port smtp pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port submission pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port pop3s pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port imaps # Proxy pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port 3128 # PostgreSQL pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port 5433 # MariaDB pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port 3306 # VAX pass stateful in final family inet4 proto tcp from any \ to 192.168.10.107 pass stateful out final family inet4 proto tcp from 192.168.10.107 \ to any # OpenVPN pass stateful out final family inet4 proto udp from any \ to 192.168.1.1 port openvpn pass stateful in final family inet4 proto udp from 192.168.1.1 \ to any port openvpn pass stateful out final family inet4 proto tcp from any \ to 192.168.1.1 port openvpn pass stateful in final family inet4 proto tcp from 192.168.1.1 \ to any port openvpn # Surveillance pass stateful in final family inet4 proto tcp from 192.168.1.1 \ to 192.168.17.0/24 port rtsp pass stateful in final family inet4 proto tcp from 192.168.1.1 \ to 192.168.17.0/24 port 2020 pass stateful in final family inet4 proto tcp from 192.168.1.1 \ to 192.168.16.0/24 port rtsp pass stateful in final family inet4 proto tcp from 192.168.1.1 \ to 192.168.16.0/24 port 2020 block final all } group "invites" on $vlan15_if { pass in final family inet4 proto icmp all pass out final family inet4 proto icmp all pass in final family inet6 proto ipv6-icmp all pass out final family inet6 proto ipv6-icmp all pass stateful in final family inet4 proto udp \ from 192.168.15.0/24 to 192.168.15.128 port domain pass stateful in final family inet4 proto udp \ from 192.168.15.0/24 port bootpc to 192.168.15.128 port bootps pass stateful in final family inet4 proto tcp \ from 192.168.15.0/24 to any port http pass stateful in final family inet4 proto tcp \ from 192.168.15.0/24 to any port https pass stateful in final family inet6 proto tcp \ from any to any port http pass stateful in final family inet6 proto tcp \ from any to any port https block final all } group "zoneminder" on $vlan16_if { pass in final family inet4 proto icmp all pass out final family inet4 proto icmp all pass stateful in final family inet4 proto udp \ from any to 192.168.16.128 port domain pass stateful out final family inet4 proto tcp \ from 192.168.1.1 to 192.168.16.0/24 port rtsp pass stateful out final family inet4 proto tcp \ from 192.168.1.1 to 192.168.17.0/24 port rtsp pass stateful out final family inet4 proto tcp \ from 192.168.1.1 to 192.168.16.0/24 port 2020 pass stateful out final family inet4 proto tcp \ from 192.168.1.1 to 192.168.17.0/24 port 2020 pass stateful in final family inet4 proto tcp \ from any to any port http pass stateful in final family inet4 proto tcp \ from any to any port https pass stateful out final family inet4 proto tcp \ from any to 192.168.16.254 port http pass stateful out final family inet4 proto tcp \ from any to 192.168.16.254 port https block final all } group "bacula" on $bacula_if { pass final all } group "video" on $video_if { pass final all } group default { pass final on lo0 all block all } rtsp is routed between zoneminder (vlan16) and dmz (re0). Why port rtsp is opened on WAN interface (wm2) ? Same question for ftp, http and https (there is no httpd on this server). Help will be welcome, JB
signature.asc
Description: OpenPGP digital signature
