Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What ports on my home router should be open, say if I'm only using it for browsing the internet. Right now these four are open,

23/tcp   open  telnet
53/tcp   open  domain
80/tcp   open  http
5000/tcp open  upnp

Should I close the other ones besides 80? What do these other ports do and if I should close them, how do I do it?

share|improve this question
    
Which router are you using? Are they open from the inside or from the Internet side? All of them are for management (unless you did define a forwarding rule). No open ports on the router are required to brose the internet –  Hendrik Brummermann Mar 11 '12 at 16:57

4 Answers 4

By "open" a port, I assume you mean forward it to the box you're browsing the internet with.

If you're only using it to browse the internet, there's no reason to open any ports. The only time you need to open (forward) a port is if you want to allow connections from the outside world to a server on your local network.

share|improve this answer
    
I agree with pfyon. For all internet browsing and other common tasks that you do from within your network, you only need outbound policies open. Which by default on a common router or firewall, is wide open. Any ports that you want to allow "inbound" to the router is going to be for remote management, port forwarding, accessing your internal network from somewhere else. –  Eric Feb 8 '12 at 21:11

An open port is for maintaining a service to which outsiders can connect. If you are a "pure client" (in your words, "only using it for browsing the Internet"), then there should be no reason to have any open port at all.

You do not say how you obtained the report on open ports you are quoting; if you ran nmap from your desktop system, then you did not obtain the actual open ports: you got the ports which are accessible from your desktop machine whereas you were interested in the ports which are accessible from the Internet at large. It is expected and reasonable that the router maintains a few ports open on the local network side, e.g. the port 80, because that's how you can configure the router.

What you want is to test that the router is answering to no connection attempt which comes from the outside. To test that, you need to run a port scanner from another system which is not part of your home network.

share|improve this answer

If all you want to do is browse the web then you may close all of the ports on your router.

Open ports are only necessary to accept incoming connections. So if you want to host a webserver then you will need port 80 open, however, if all you want to do is access other peoples webservers then port 80 (and all other ports) may be safely closed.

share|improve this answer

From what I see here it looks like you scanned the internal IP address of your router (also your default gateway). The services that you see running should only be accessible from inside your network on the default gateway IP address.

Port 23: Telnet - Command line access to administer your router.

Port 53 DNS (domain name service) - resolves hostnames to ip addresses.

Port 80 HTTP - a webserver running the graphical interface used to administer your Router.

Port 5000 UPNP (universal plug and play) - This is a network discovery protocol which allows devices to find and configure other network devices.

As far as which services are needed to browse the web technically none of them are needed. However some of these services are required for you to administer your device. If you can disable telnet I would recommend that be turned off unless you prefer to configure it via the command line. If you do prefer CLI administration I would look into seeing if your device supports SSH as it is more secure. DNS can also be turned off on your router I recommend using your ISP's DNS servers as they tend to be the fastest available option but this is always debatable. Regardless of this fact DNS is optional. UPNP is also optional but it should be turned off unless you require it.

As far as your public facing IP address goes I would scan the ports from and outside host or using a service like shields up. All ports can and should be closed if you are using your service primarily to browse the internet.

share|improve this answer
    
I would add that nowadays you should never use telnet anymore (use ssh; essentially a secure telent on port 22), and the UPnP has nothing to do with playing video games online. Its a protocol for devices on a network to seemlessly discover each other (e.g., plug and play); e.g., you install a network printer on your local network and all your computers on your network will have another printer listed on their printing choices without you doing anything; or you can stream media from your computer on your TV/vice versa. It also should use ports 2869 (TCP) 1900 (UDP) not 5000 (old standard). –  dr jimbob Feb 9 '12 at 15:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.