Nmap is returning different results when run on different source networks on the target same network

Question

I am running a CODA4680 in bridge mode connected to my pfsense 1100 (and yes it is getting a true public ip). I set it up the standard way, didn't touch the rules.

I performed an NMAP scan from my laptop tethered to my LTE hotspot from my phone and I see

Port/protocol	Status	Service
21/tcp	open	ftp
80/tcp	open	http
135/tcp	closed	msrpc
139/tcp	closed	netbios-ssn
445/tcp	closed	microsoft-ds
646/tcp	closed	ldp
711/tcp	closed	cisco-tdp

I'm thinking there's maybe something with the LTE? Some device in my phone carrier's setup? Could the router in bridge mode have ports open? That would seem strange to me.

My firewall is not cisco, i don't understand why there would be ANY microsoft stuff on it so it's just weird

Even weirder is when I go on another (non-LTE) network and run the same command with the same target IP i get:

Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn 
Nmap done: 1 IP address (0 hosts up)

So it's something on the LTE network that's doing something strange?

(Also yes, I made sure I'm running the scan on the same IP, it's not a DNS issue)

Answer 1

So it's something on the LTE network that's doing something strange?? What. The. Heck?

It is a practice that ISP including mobile ISP might block certain ports in order to protect customers or in order to limit the impact of compromised customer machines. For example from at&t network practices:

... For example, as described in more detail below, we block certain ports that transfer malicious or disruptive traffic (such as Ports 25, 135, 139, 445, and 1900).

And it describes some ports in detail, like

Port 135/TCP: NetBIOS is a network file sharing protocol and is also known as Common Internet File System or LanManager. Blocking protects customers from exposing files unintentionally, worms, and viruses.

Interesting is also a report from the Broadband Internet Technical Advisory Group where they describe in detail why one should or should block certain ports.

But why are certain ports showing open like 21 and 80?

As for open port 21: it could be some transparent FTP helper which is needed to pass FTP traffic through NAT/CG-NAT networks and mobile ISP usually do CG-NAT. And for open port 80: maybe the ISP uses a transparent caching proxy there and/or they do HTTP header enrichment.