Hola compis,espero que os encontreis bieb ,he descatgado la version actualizada de Debian y  he quedado asombrado ya que he visto numerosoa ports abiertos que intentado cerrar con iptabes y se vuelven  abrir ,enter vosotros hay alguien que le haya pasado lo mismo,,gracias

mira tu mismo :)si podeis explicarme un poco os lo agradeceria,no se si es con la edad ..que a veces olvido muchas cosas...como puedo cerrar puertos y hago asi pero vuelven abrirse ::


iptables -A INPUT -p tcp --dport 1 -j DROP
iptables -A INPUT -p udp --dport 1 -j DROP


Starting Nmap 7.70 ( https://nmap.org ) at 2021-03-29 11:22 AKDT
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 11:22
Completed NSE at 11:22, 0.00s elapsed
Initiating NSE at 11:22
Completed NSE at 11:22, 0.00s elapsed
Initiating SYN Stealth Scan at 11:22
Scanning localhost (127.0.0.1) [1000 ports]
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 143/tcp on 127.0.0.1
Discovered open port 80/tcp on 127.0.0.1
Discovered open port 111/tcp on 127.0.0.1
Discovered open port 53/tcp on 127.0.0.1
Discovered open port 6667/tcp on 127.0.0.1
Discovered open port 12345/tcp on 127.0.0.1
Discovered open port 2000/tcp on 127.0.0.1
Discovered open port 32771/tcp on 127.0.0.1
Discovered open port 1/tcp on 127.0.0.1
Discovered open port 31337/tcp on 127.0.0.1
Discovered open port 119/tcp on 127.0.0.1
Discovered open port 631/tcp on 127.0.0.1
Discovered open port 79/tcp on 127.0.0.1
Discovered open port 32774/tcp on 127.0.0.1
Discovered open port 1524/tcp on 127.0.0.1
Discovered open port 9040/tcp on 127.0.0.1
Discovered open port 32772/tcp on 127.0.0.1
Discovered open port 32773/tcp on 127.0.0.1
Discovered open port 1080/tcp on 127.0.0.1
Discovered open port 9050/tcp on 127.0.0.1
Completed SYN Stealth Scan at 11:23, 1.58s elapsed (1000 total ports)
Initiating Service scan at 11:23
Scanning 21 services on localhost (127.0.0.1)
Completed Service scan at 11:23, 6.07s elapsed (21 services on 1 host)
Initiating OS detection (try #1) against localhost (127.0.0.1)
Retrying OS detection (try #2) against localhost (127.0.0.1)
Retrying OS detection (try #3) against localhost (127.0.0.1)
Retrying OS detection (try #4) against localhost (127.0.0.1)
Retrying OS detection (try #5) against localhost (127.0.0.1)
NSE: Script scanning 127.0.0.1.
Initiating NSE at 11:23
Completed NSE at 11:23, 10.18s elapsed
Initiating NSE at 11:23
Completed NSE at 11:23, 0.00s elapsed
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00025s latency).
Not shown: 979 closed ports
PORT      STATE SERVICE    VERSION
1/tcp     open  tcpwrapped
22/tcp    open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 74:ef:4d:60:46:d1:02:a9:e5:66:8a:16:ff:7a:27:99 (RSA)
|   256 5c:07:2a:5c:cc:53:93:00:1c:36:17:5f:63:3c:79:ee (ECDSA)
|_  256 70:84:7f:c1:5d:1e:05:ac:74:64:ac:eb:9a:b9:c8:21 (ED25519)
53/tcp    open  domain     dnsmasq 2.80
| dns-nsid:
|_  bind.version: dnsmasq-2.80
79/tcp    open  tcpwrapped
|_finger: ERROR: Script execution failed (use -d to debug)
80/tcp    open  http       Apache httpd 2.4.38 ((Debian))
| http-methods:
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Apache2 Debian Default Page: It works
111/tcp   open  tcpwrapped
119/tcp   open  tcpwrapped
143/tcp   open  tcpwrapped
631/tcp   open  ipp        CUPS 2.2
| http-methods:
|   Supported Methods: GET HEAD OPTIONS POST PUT
|_  Potentially risky methods: PUT
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: CUPS/2.2 IPP/2.1
|_http-title: Home - CUPS 2.2.10
1080/tcp  open  tcpwrapped
1524/tcp  open  tcpwrapped
2000/tcp  open  tcpwrapped
6667/tcp  open  tcpwrapped
|_irc-info: Unable to open connection
9040/tcp  open  tcpwrapped
9050/tcp  open  tor-socks  Tor SOCKS proxy
| socks-auth-info:
|   No authentication
|_  Username and password
| socks-open-proxy:
|   status: open
|   versions:
|     socks4
|_    socks5
12345/tcp open  tcpwrapped
31337/tcp open  tcpwrapped
32771/tcp open  tcpwrapped
32772/tcp open  tcpwrapped
32773/tcp open  tcpwrapped
32774/tcp open  tcpwrapped
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.70%E=4%D=3/29%OT=22%CT=3%CU=40496%PV=N%DS=0%DC=L%G=Y%TM=6062293
OS:3%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10C%TI=Z%CI=Z%TS=A)OPS(O1=M
OS:FFD7ST11NW7%O2=MFFD7ST11NW7%O3=MFFD7NNT11NW7%O4=MFFD7ST11NW7%O5=MFFD7ST1
OS:1NW7%O6=MFFD7ST11)WIN(W1=FFCB%W2=FFCB%W3=FFCB%W4=FFCB%W5=FFCB%W6=FFCB)EC
OS:N(R=Y%DF=Y%T=40%W=FFD7%O=MFFD7NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F
OS:=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5
OS:(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z
OS:%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=
OS:G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 5.600 days (since Tue Mar 23 21:00:06 2021)
Network Distance: 0 hops
TCP Sequence Prediction: Difficulty=257 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Initiating NSE at 11:23
Completed NSE at 11:23, 0.00s elapsed
Initiating NSE at 11:23
Completed NSE at 11:23, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.92 seconds
           Raw packets sent: 1310 (68.576KB) | Rcvd: 2653 (128.528KB)

Algunos puntos:

1) 127.0.0.1 es tu loopback, si tienes servicios escuchando ahí no necesariamente están expuestos a otros equipos. Por lo general no se bloquea la loopback tanto, pero si se protege contra spoofing y otros ataques.

2) Las reglas que agregues por medio de iptables no se persisten entre arranques. Necesitas dumpear las reglas y guardarlas en un archivo. (como con la utilidad iptables-save)

3) Tus reglas de iptables solo están bloqueando conexiones entrantes en el puerto destino 1.


A menos que especifiques el argumento -i se usa cualquier interface. Por eso era común agregar una regla para -i lo que dejara pasar tráfico o especificar la interface de red (e.g. eno1 o eth0) en las reglas de bloqueo.

Por cierto, Debian 10.9 viene con nftables. Me parece que hay una capa de compatibilidad entre iptables y nftables. Al menos yo sigo usando comandos con iptables en mi sistema arch (pero la realidad es que usa nftables detrás).

si es que en realidad tengo un problema ,por culpa mia ;results que hace dos meses un dia antes de ir a trabajar no me encontraba muy bien ,y fui igualmente ,despues de unas horas ,se me nublaba la vista y
me dijo el jefe que fuera al medico ,durante el camino de vuelta a casa iba muy despacio para no provocar ningun acidente ,cuando llego al parking que es en el subterraneo del edificio ,me equivoque y aparque en la plaza de un vecino cuando mi hija me vio asi en ese estado ,fue mirar al parking y me dijo que habia aparcado en la plaza equivocada y le dije que fuera a su casa y que le dijese lo que me ocurria
y que por favor aparcase en nuestra plaza que ya lo moveria cuando estuviese mejor ,bueno parece ser
que con mi hija se puso furioso y estaba muy emnfadado ,yo la misma noche fui a trancas y barrancas cambiar el coche ,el cual  lo veo que estaba rallado en las puertas  y bueno no dije nada;y a raiz de esto empezamos a tener problemas con la conexion ,la wifi no nos va apartir de las 6 de la tarde hasta las dosde la mańana ,luego estas viendo algo en youtube y va a golpes,por eso estoy desconfiado asi.
y en realidad estamos siempre en el la red de tor por precaucion,lo que me pregunto es como hace para saber mi ip publica y privada ;he mirado si teniamos una puerta trasear en el router o algun malwarer
instalado ;lo de los ojos es que habia cojido el coronavirus ,seguramente en algun ascensor ,mismo en mi edificio ,meter la mascarilla esto no es una broma,me ha quedado una secuela que es que no oigo como antes .
bueno he hecho lo que me habeis dicho y estos puertos se abren solo cuando estoy en proxy tor y con la interface lo (loopack) ;haciendo un escaneo a la ip interna ,solo hay dos abiertos :el 80 y 53:
no meto todos los escaneos ,para no ocupar mucho sitio:

Starting Nmap 7.70 ( https://nmap.org ) at 2021-03-29 23:54 AKDT
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 23:54
Completed NSE at 23:54, 0.00s elapsed
Initiating NSE at 23:54
Completed NSE at 23:54, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 23:54
Completed Parallel DNS resolution of 1 host. at 23:54, 0.01s elapsed
Initiating SYN Stealth Scan at 23:54
Scanning 192.168.1.44 [1000 ports]
Discovered open port 53/tcp on 192.168.1.44
Discovered open port 80/tcp on 192.168.1.44
Increasing send delay for 192.168.1.44 from 0 to 5 due to 11 out of 24 dropped probes since last increase.
Increasing send delay for 192.168.1.44 from 5 to 10 due to 11 out of 26 dropped probes since last increase.
SYN Stealth Scan Timing: About 32.83% done; ETC: 23:55 (0:01:03 remaining)
Warning: 192.168.1.4 giving up on port because retransmission cap hit (6).
SYN Stealth Scan Timing: About 61.47% done; ETC: 23:56 (0:00:38 remaining)
Completed SYN Stealth Scan at 23:56, 101.67s elapsed (1000 total ports)
Initiating Service scan at 23:56
Scanning 2 services on 192.168.1.44
Completed Service scan at 23:56, 6.15s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.1.44
Retrying OS detection (try #2) against 192.168.1.44
Retrying OS detection (try #3) against 192.168.1.44
Retrying OS detection (try #4) against 192.168.1.44
Retrying OS detection (try #5) against 192.168.1.44
NSE: Script scanning 192.168.1.44
Initiating NSE at 23:56
Completed NSE at 23:56, 8.70s elapsed
Initiating NSE at 23:56
Completed NSE at 23:56, 0.00s elapsed
Nmap scan report for 192.168.1.44
Host is up (0.013s latency).
Not shown: 924 filtered ports, 74 closed ports
PORT   STATE SERVICE VERSION
53/tcp open  domain  dnsmasq 2.80
| dns-nsid:
|_  bind.version: dnsmasq-2.80
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
| http-methods:
|_  Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Apache2 Debian Default Page: It works
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.70%E=4%D=3/29%OT=53%CT=443%CU=33790%PV=Y%DS=0%DC=L%G=Y%TM=6062D
OS:9B4%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10C%TI=Z%TS=A)SEQ(SP=106%
OS:GCD=1%ISR=10C%TI=Z%II=I%TS=A)ECN(R=Y%DF=Y%TG=40%W=FFD7%O=MFFD7NNSNW7%CC=
OS:Y%Q=)ECN(R=Y%DF=Y%T=40%W=FFD7%O=MFFD7NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%TG=40%S=
OS:O%A=S+%F=AS%RD=0%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N
OS:)T4(R=Y%DF=Y%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A
OS:=Z%F=R%O=%RD=0%Q=)T5(R=N)T6(R=Y%DF=Y%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T6
OS:(R=Y%DF=Y%T=40%W=0%S=O%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=N)U1(R=Y%DF=N%T=40
OS:%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%TG=40%CD=S)
OS:IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 35.048 days (since Mon Feb 22 21:46:48 2021)
Network Distance: 0 hops
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros

NSE: Script Post-scanning.
Initiating NSE at 23:56
Completed NSE at 23:56, 0.00s elapsed
Initiating NSE at 23:56
Completed NSE at 23:56, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 131.51 seconds
           Raw packets sent: 6918 (314.340KB) | Rcvd: 1884 (125.646KB)

----------------------Estando en tor -------------escaneo a lo 127.0.0.1

Starting Nmap 7.70 ( https://nmap.org ) at 2021-03-30 00:54 AKDT
NSE: Loaded 148 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 00:54
Completed NSE at 00:54, 0.00s elapsed
Initiating NSE at 00:54
Completed NSE at 00:54, 0.00s elapsed
Initiating SYN Stealth Scan at 00:54
Scanning localhost (127.0.0.1) [1000 ports]
Discovered open port 80/tcp on 127.0.0.1
Discovered open port 111/tcp on 127.0.0.1
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 143/tcp on 127.0.0.1
Discovered open port 53/tcp on 127.0.0.1
Discovered open port 1524/tcp on 127.0.0.1
Discovered open port 32774/tcp on 127.0.0.1
Discovered open port 12345/tcp on 127.0.0.1
Discovered open port 9040/tcp on 127.0.0.1
Discovered open port 631/tcp on 127.0.0.1
Discovered open port 1/tcp on 127.0.0.1
Discovered open port 32772/tcp on 127.0.0.1
Discovered open port 9050/tcp on 127.0.0.1
Discovered open port 6667/tcp on 127.0.0.1
Discovered open port 32773/tcp on 127.0.0.1
Discovered open port 32771/tcp on 127.0.0.1
Discovered open port 31337/tcp on 127.0.0.1
Discovered open port 2000/tcp on 127.0.0.1
Discovered open port 1080/tcp on 127.0.0.1
Discovered open port 119/tcp on 127.0.0.1
Discovered open port 79/tcp on 127.0.0.1
Completed SYN Stealth Scan at 00:54, 1.57s elapsed (1000 total ports)
Initiating Service scan at 00:54
Scanning 21 services on localhost (127.0.0.1)
Completed Service scan at 00:54, 6.07s elapsed (21 services on 1 host)
Initiating OS detection (try #1) against localhost (127.0.0.1)
NSE: Script scanning 127.0.0.1.
Initiating NSE at 00:54
Completed NSE at 00:54, 10.19s elapsed
Initiating NSE at 00:54
Completed NSE at 00:54, 0.00s elapsed
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00033s latency).
Not shown: 979 closed ports
PORT      STATE SERVICE    VERSION
1/tcp     open  tcpwrapped
22/tcp    open  ssh        OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 74:ef:4d:60:46:d1:02:a9:e5:66:8a:16:ff:7a:27:99 (RSA)
|   256 5c:07:2a:5c:cc:53:93:00:1c:36:17:5f:63:3c:79:ee (ECDSA)
|_  256 70:84:7f:c1:5d:1e:05:ac:74:64:ac:eb:9a:b9:c8:21 (ED25519)
53/tcp    open  domain     dnsmasq 2.80
| dns-nsid:
|_  bind.version: dnsmasq-2.80
79/tcp    open  tcpwrapped
|_finger: ERROR: Script execution failed (use -d to debug)
80/tcp    open  http       Apache httpd 2.4.38 ((Debian))
| http-methods:
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Apache2 Debian Default Page: It works
111/tcp   open  tcpwrapped
119/tcp   open  tcpwrapped
143/tcp   open  tcpwrapped
631/tcp   open  ipp        CUPS 2.2
| http-methods:
|   Supported Methods: GET HEAD OPTIONS POST PUT
|_  Potentially risky methods: PUT
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: CUPS/2.2 IPP/2.1
|_http-title: Home - CUPS 2.2.10
1080/tcp  open  tcpwrapped
1524/tcp  open  tcpwrapped
2000/tcp  open  tcpwrapped
6667/tcp  open  tcpwrapped
|_irc-info: Unable to open connection
9040/tcp  open  tcpwrapped
9050/tcp  open  tor-socks  Tor SOCKS proxy
| socks-auth-info:
|   Username and password
|_  No authentication
| socks-open-proxy:
|   status: open
|   versions:
|     socks4
|_    socks5
12345/tcp open  tcpwrapped
31337/tcp open  tcpwrapped
32771/tcp open  tcpwrapped
32772/tcp open  tcpwrapped
32773/tcp open  tcpwrapped
32774/tcp open  tcpwrapped
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Uptime guess: 8.756 days (since Sun Mar 21 06:45:50 2021)
Network Distance: 0 hops
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
Initiating NSE at 00:54
Completed NSE at 00:54, 0.00s elapsed
Initiating NSE at 00:54
Completed NSE at 00:54, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.40 seconds
           Raw packets sent: 1121 (52.028KB) | Rcvd: 2268 (99.490KB)


la interface lo  puede ser hackeada y provocarme esos problemas?podria cerrarlos para siempre? y como ;gracias por vuestra ayuda tan valiosa

Los puertos abiertos no tienen nada que ver con el estado del wifi. Por otro lado TOR puede ser muy lento. Yo te recomendaría que no usaras TOR para Youtube y csoas así...

Lo de la historia de tu vecino no viene mucho al caso, dudo mucho que estés siendo atacado por tu vecino a través de estos puertos. Tienes un servidor apache y un servidor DNS corriendo, si no los usas toca deshabilitar estos servicios.