filtered versus closed (port state)

Two of the three verdicts nmap -Pn 198.51.100.25 returns. They describe what came back, not how protected you are. closed: the machine answered — an RST saying nothing here — so the packet crossed every filter on the way and found no listening socket. filtered: nothing came back at all, something dropped the SYN in silence. Reading closed as protected inverts the finding. 5432/tcp closed says the firewall lets the port through and PostgreSQL is not running today; the morning somebody starts a container it turns open with not one rule changed. On that line, filtered is the result you want. Seen from the client, the same distinction is refused versus timed out. --reason prints the exact response behind each verdict.