How to hide port from nmap?

Question

linux

Good day to all!
Actually, there is a server on Debian, a number of services with forwarded ports are running on it.
When scanning the server IP using nmap, you can see all open ports and versions of services looking at the world (ssh, webmin, gui router), except for OpenVPN. Question:
- Why can't I see the open port of OpenVPN?
- How to hide all other ports from scanning?
UPD Output of nmap-a:
#nmap -sU XXX.XXX.XXX.XXX
Starting Nmap 6.47 ( nmap.org ) at 2015-03-06 15:57 RTZ 2 (winter)
Nmap scan report for XXX.XXX.XXX.XXX
Host is up (0.027s latency).
All 1000 scanned ports on XXX.XXX.XXX.XXX are open|filtered
Nmap done: 1 IP address (1 host up) scanned in 29.44 seconds
Without the -sU switch (no VPN port here):
#nmap XXX.XXX.XXX.XXX
Starting Nmap 6.47 ( nmap.org ) at 2015-03-06 16:00 RTZ 2 (winter)
Nmap scan report for XXX.XXX. XXX.XXX
Host is up (0.032s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE
2200/tcp open ici
8081/tcp open blackice-icecap
20000/tcp open dnp
Nmap done: 1 IP address (1 host up) scanned in 14.29 seconds
With the -sV switch, displays the same ports + the version of SSH, Webmin and some kind of cracks in the web muzzle of the router.

Answer 1

openvpn uses udp by default, if you run a scan with no options, nmap only shows tcp. add the -sU parameter,
I think it's impossible to hide them 100%

Answer 2

nmap when scanning a specific TCP / UDP port says that it is closed? then, in theory, openVPN will not work either :)
but in general, it is architecturally assumed that public services have open ports, otherwise how to connect to them.
If you want to hide all your goodness, then do not forward ports and do not turn on the webadmin on the external, use the services only through your VPN.
Of course, you can still Port knocking, but these are still bicycles.

Answer 3

You can try like this

iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP

Answer 4

OpenVPN uses HMAC to protect against a port scanner.