Hello,
I have a complex NPF confiuration on a server and I don't understand
why ftp and rtsp ports are opened. From WAN, namp returns:
Root riemann:[~] > nmap -4 legendre.systella.fr
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-20 16:18 +0200
Nmap scan report for legendre.systella.fr (188.231.16.145)
Host is up (0.059s latency).
Other addresses for legendre.systella.fr (not scanned):
2a0a:1c84:1000:a00::3
Not shown: 995 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
443/tcp open https
554/tcp open rtsp
Nmap done: 1 IP address (1 host up) scanned in 6.34 seconds
Root riemann:[~] > nmap -6 legendre.systella.fr
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-20 16:19 +0200
Nmap scan report for legendre.systella.fr (2a0a:1c84:1000:a00::3)
Host is up (0.11s latency).
Other addresses for legendre.systella.fr (not scanned): 188.231.16.145
Not shown: 995 filtered tcp ports (no-response)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
443/tcp open https
554/tcp open rtsp
Nmap done: 1 IP address (1 host up) scanned in 27.92 seconds
Root riemann:[~]
Please not open status for TCP/21 and TCP/554.
This server has a lot of network adapters:
- bridge0 (wm0/wm1) 192.168.12.1/24
- WAN (wm2) 188.231.16.145/29, 2a0a:1c84:1000:a00::3/64
- lagg0 (wm3/wm4) 192.168.10.128/24, 2a0a:1c84:1000:a10::128/64
- DMZ (re0) 192.168.1.2/24, 2a0a:1c84:1000:a01::2/64
- VLAN15 192.168.15.128/24, 2a0a:1c84:1000:a15::128/64
- VLAN16 192.168.16.128/24, 2a0a:1c84:1000:a16::128/64
Server in DMZ has another WAN access.
My npf.conf is:
$lan_if = "lagg0"
$wan_if = "wm2"
$bacula_if = "wm1"
$video_if = "wm0"
$ext_v4 = inet4($wan_if)
$dmz_if = "re0"
$vlan15_if = "vlan15"
$vlan16_if = "vlan16"
set bpf.jit on;
alg "icmp"
# Redirection pour les torrents (avant le NAT !)
#map $ext_v4 static 192.168.10.103 port 10241 <-> $ext_v4 port 10241
# Outgoing NAT
map inet4($wan_if) dynamic 192.168.10.0/24 -> $ext_v4
map inet4($wan_if) dynamic 192.168.12.0/24 -> $ext_v4
map inet4($wan_if) dynamic 192.168.15.0/24 -> $ext_v4
map inet4($wan_if) dynamic 192.168.16.0/24 -> $ext_v4
procedure "log" {
log: npflog0
}
group "wan" on $wan_if {
ruleset "blocklistd"
# ICMP
pass in final family inet4 proto icmp all
pass out final family inet4 proto icmp all
pass in final family inet6 proto ipv6-icmp all
pass out final family inet6 proto ipv6-icmp all
# ntp
pass stateful out final family inet4 proto udp from $wan_if port
ntp \
to any port ntp
pass stateful in final family inet4 proto udp from $wan_if port
ntp \
to any port ntp
# ssh
pass stateful out final family inet4 proto tcp from $wan_if \
to any port ssh
pass stateful in final family inet4 proto tcp from any \
to $wan_if port ssh
pass stateful out final family inet6 proto tcp from $wan_if \
to any port ssh
pass stateful in final family inet6 proto tcp from any \
to $wan_if port ssh
# ftp
#pass stateful out final family inet4 proto tcp from $wan_if \
# to any port ftp
# http/https
pass stateful out final family inet4 proto tcp from $wan_if \
to any port http
pass stateful out final family inet4 proto tcp from $wan_if \
to any port https
pass stateful out final family inet4 proto tcp from $wan_if \
to any port 8080
pass stateful out final family inet6 proto tcp from any \
to any port http
pass stateful out final family inet6 proto tcp from any \
to any port https
# SVN
pass stateful out final family inet4 proto tcp from $wan_if \
to any port svn
# git
pass stateful out final family inet4 proto tcp from $wan_if \
to any port git
pass stateful out final family inet6 proto tcp from $wan_if \
to any port git
# DNS
pass stateful out final family inet4 from $wan_if to any port domain
#pass stateful in final family inet4 from any to $wan_if port domain
pass stateful out final family inet6 from $wan_if to any port domain
# NAT
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port http
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port 8080
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port https
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port ssh
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port imaps
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port pop3s
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port submission
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port smtp
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port ftp
pass stateful out final family inet4 \
from 192.168.10.0/24 to any port ntp
pass stateful out final family inet4 \
from 192.168.10.0/24 to any port nntp
pass stateful out final family inet4 \
from 192.168.10.0/24 to any port git
pass stateful out final family inet4 proto icmp \
from 192.168.10.0/24
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port openvpn
pass stateful out final family inet4 proto udp \
from 192.168.10.0/24 to any port openvpn
pass stateful out final family inet4 proto tcp \
from 192.168.12.0/24 to any port https
pass stateful out final family inet4 proto tcp \
from 192.168.15.0/24 to any port http
pass stateful out final family inet4 proto tcp \
from 192.168.15.0/24 to any port https
# PAS D'ACCES INTERNET POUR LE VLAN16 sauf pour la configuration
# Le firmware passe en http !
pass stateful out final family inet4 proto tcp \
from 192.168.16.0/24 to any port http
pass stateful out final family inet4 proto tcp \
from 192.168.16.0/24 to any port https
pass stateful out final family inet4 proto tcp \
from 192.168.17.0/24 to any port http
pass stateful out final family inet4 proto tcp \
from 192.168.17.0/24 to any port https
# Video CNED
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to any port 8800
# VoIP over WIFI (Orange)
pass stateful out final family inet4 proto udp \
from 192.168.10.104/32 to any port 500
pass stateful out final family inet4 proto udp \
from 192.168.10.104/32 to any port 4500
# port i2p sur hilbert
pass stateful in final family inet4 from any to $wan_if port 10242
pass stateful out final family inet4 from 192.168.10.103 port
10242 to any
pass stateful in final family inet6 from any to $wan_if port 10242
pass stateful out final family inet6 from \
2a0a:1c84:1000:a10:d65d:64ff:feb4:9a3b port
10242 to any
# ProtonVPN
pass stateful in final family inet4 from any to $wan_if port 1194
pass stateful out final family inet4 from 192.168.10.103 port
1194 to any
# domain sur hilbert
pass stateful out final family inet4 \
from 192.168.10.103 to any port domain
pass stateful out final family inet6 from \
2a0a:1c84:1000:a10:d65d:64ff:feb4:9a3b to any
port domain
# mx2
pass stateful in final family inet4 proto tcp \
from any to $wan_if port smtp
pass stateful in final family inet6 proto tcp \
from any to $wan_if port smtp
# Actication Windows
pass stateful out final family inet4 proto tcp from any to any
port 1688
#pass stateful in final family inet4 proto tcp from any port
1688 to any
# Wireguard VPN
pass stateful out final family inet4 from any port 51825 to any
pass stateful out final family inet6 from any port 51825 to any
pass stateful out final family inet4 from 188.231.16.145 to
188.231.16.146
pass stateful in final family inet4 from 188.231.16.146 to
188.231.16.145
# Default
block final all
}
group "lan" on $lan_if {
pass final all
}
group "dmz" on $dmz_if {
pass in final family inet4 proto icmp all
pass out final family inet4 proto icmp all
pass in final family inet6 proto ipv6-icmp all
pass out final family inet6 proto ipv6-icmp all
# ssh
pass stateful out final family inet4 proto tcp from any \
to any port ssh
pass stateful in final family inet4 proto tcp from any \
to any port ssh
# git
pass stateful out final family inet4 proto tcp from any \
to any port git
pass stateful in final family inet4 proto tcp from any \
to any port git
# rsync
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port rsync
# DNS
pass stateful out final family inet4 from any to any port domain
pass stateful in final family inet4 from 192.168.1.1 to any \
port domain
pass stateful in final family inet4 from 192.168.2.0/24 to any \
port domain
# Greylist
pass stateful in final family inet4 from any to 192.168.1.2 \
port 5252
pass stateful out final family inet4 from any to 192.168.1.1 \
port 5252
# http
# https
pass stateful in final family inet4 proto tcp from any \
to any port http
pass stateful in final family inet4 proto tcp from any \
to any port https
pass stateful out final family inet4 proto tcp from any \
to any port http
pass stateful out final family inet4 proto tcp from any \
to any port https
pass stateful out final family inet4 proto tcp from any \
to any port 8080
pass stateful out final family inet6 proto tcp from any \
to any port http
pass stateful out final family inet6 proto tcp from any \
to any port https
# solr
pass stateful out final family inet4 proto tcp from any \
to any port 8983
# ntp
pass stateful out final family inet4 proto udp from any \
to any port ntp
# jitsi
pass stateful out final family inet4 proto tcp \
from 192.168.10.0/24 to 192.168.1.1 port 4443
pass out final family inet4 proto udp \
from 192.168.10.0/24 to 192.168.1.1 port 10000
pass in final family inet4 proto udp \
from 192.168.1.1 port 10000 to 192.168.10.0/24
# VoIP
pass out final family inet4 proto udp from 192.168.10.250 \
to 192.168.1.1
pass in final family inet4 proto udp from 192.168.1.1 \
to 192.168.10.250
pass out final family inet4 proto udp from 192.168.10.253 \
to 192.168.1.1
pass in final family inet4 proto udp from 192.168.1.1 \
to 192.168.10.253
# ESMTP
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port smtp
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port submission
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port pop3s
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port imaps
# Proxy
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port 3128
# PostgreSQL
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port 5433
# MariaDB
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port 3306
# VAX
pass stateful in final family inet4 proto tcp from any \
to 192.168.10.107
pass stateful out final family inet4 proto tcp from 192.168.10.107 \
to any
# OpenVPN
pass stateful out final family inet4 proto udp from any \
to 192.168.1.1 port openvpn
pass stateful in final family inet4 proto udp from 192.168.1.1 \
to any port openvpn
pass stateful out final family inet4 proto tcp from any \
to 192.168.1.1 port openvpn
pass stateful in final family inet4 proto tcp from 192.168.1.1 \
to any port openvpn
# Surveillance
pass stateful in final family inet4 proto tcp from 192.168.1.1 \
to 192.168.17.0/24 port rtsp
pass stateful in final family inet4 proto tcp from 192.168.1.1 \
to 192.168.17.0/24 port 2020
pass stateful in final family inet4 proto tcp from 192.168.1.1 \
to 192.168.16.0/24 port rtsp
pass stateful in final family inet4 proto tcp from 192.168.1.1 \
to 192.168.16.0/24 port 2020
block final all
}
group "invites" on $vlan15_if {
pass in final family inet4 proto icmp all
pass out final family inet4 proto icmp all
pass in final family inet6 proto ipv6-icmp all
pass out final family inet6 proto ipv6-icmp all
pass stateful in final family inet4 proto udp \
from 192.168.15.0/24 to 192.168.15.128 port domain
pass stateful in final family inet4 proto udp \
from 192.168.15.0/24 port bootpc to
192.168.15.128 port bootps
pass stateful in final family inet4 proto tcp \
from 192.168.15.0/24 to any port http
pass stateful in final family inet4 proto tcp \
from 192.168.15.0/24 to any port https
pass stateful in final family inet6 proto tcp \
from any to any port http
pass stateful in final family inet6 proto tcp \
from any to any port https
block final all
}
group "zoneminder" on $vlan16_if {
pass in final family inet4 proto icmp all
pass out final family inet4 proto icmp all
pass stateful in final family inet4 proto udp \
from any to 192.168.16.128 port domain
pass stateful out final family inet4 proto tcp \
from 192.168.1.1 to 192.168.16.0/24 port rtsp
pass stateful out final family inet4 proto tcp \
from 192.168.1.1 to 192.168.17.0/24 port rtsp
pass stateful out final family inet4 proto tcp \
from 192.168.1.1 to 192.168.16.0/24 port 2020
pass stateful out final family inet4 proto tcp \
from 192.168.1.1 to 192.168.17.0/24 port 2020
pass stateful in final family inet4 proto tcp \
from any to any port http
pass stateful in final family inet4 proto tcp \
from any to any port https
pass stateful out final family inet4 proto tcp \
from any to 192.168.16.254 port http
pass stateful out final family inet4 proto tcp \
from any to 192.168.16.254 port https
block final all
}
group "bacula" on $bacula_if {
pass final all
}
group "video" on $video_if {
pass final all
}
group default {
pass final on lo0 all
block all
}
rtsp is routed between zoneminder (vlan16) and dmz (re0). Why port rtsp
is opened on WAN interface (wm2) ? Same question for ftp, http and https
(there is no httpd on this server).
Help will be welcome,
JB
Attachment:
signature.asc
Description: OpenPGP digital signature