8

What ports on my home router should be open, say if I'm only using it for browsing the internet. Right now these four are open,

23/tcp   open  telnet
53/tcp   open  domain
80/tcp   open  http
5000/tcp open  upnp

Should I close the other ones besides 80? What do these other ports do and if I should close them, how do I do it?

2
  • Which router are you using? Are they open from the inside or from the Internet side? All of them are for management (unless you did define a forwarding rule). No open ports on the router are required to brose the internet Mar 11, 2012 at 16:57
  • Be aware that there is a big difference between inbound and outbound ports. There is, for example, no reason to have tcp/80 inbound open unless you run an own webserver on your machine.
    – Philipp
    Jan 2, 2016 at 14:03

4 Answers 4

10

An open port is for maintaining a service to which outsiders can connect. If you are a "pure client" (in your words, "only using it for browsing the Internet"), then there should be no reason to have any open port at all.

You do not say how you obtained the report on open ports you are quoting; if you ran nmap from your desktop system, then you did not obtain the actual open ports: you got the ports which are accessible from your desktop machine whereas you were interested in the ports which are accessible from the Internet at large. It is expected and reasonable that the router maintains a few ports open on the local network side, e.g. the port 80, because that's how you can configure the router.

What you want is to test that the router is answering to no connection attempt which comes from the outside. To test that, you need to run a port scanner from another system which is not part of your home network.

3

By "open" a port, I assume you mean forward it to the box you're browsing the internet with.

If you're only using it to browse the internet, there's no reason to open any ports. The only time you need to open (forward) a port is if you want to allow connections from the outside world to a server on your local network.

1
  • I agree with pfyon. For all internet browsing and other common tasks that you do from within your network, you only need outbound policies open. Which by default on a common router or firewall, is wide open. Any ports that you want to allow "inbound" to the router is going to be for remote management, port forwarding, accessing your internal network from somewhere else.
    – Eric
    Feb 8, 2012 at 21:11
2

From what I see here it looks like you scanned the internal IP address of your router (also your default gateway). The services that you see running should only be accessible from inside your network on the default gateway IP address.

Port 23: Telnet - Command line access to administer your router.

Port 53 DNS (domain name service) - resolves hostnames to ip addresses.

Port 80 HTTP - a webserver running the graphical interface used to administer your Router.

Port 5000 UPNP (universal plug and play) - This is a network discovery protocol which allows devices to find and configure other network devices.

As far as which services are needed to browse the web technically none of them are needed. However some of these services are required for you to administer your device. If you can disable telnet I would recommend that be turned off unless you prefer to configure it via the command line. If you do prefer CLI administration I would look into seeing if your device supports SSH as it is more secure. DNS can also be turned off on your router I recommend using your ISP's DNS servers as they tend to be the fastest available option but this is always debatable. Regardless of this fact DNS is optional. UPNP is also optional but it should be turned off unless you require it.

As far as your public facing IP address goes I would scan the ports from and outside host or using a service like shields up. All ports can and should be closed if you are using your service primarily to browse the internet.

1
  • 1
    I would add that nowadays you should never use telnet anymore (use ssh; essentially a secure telent on port 22), and the UPnP has nothing to do with playing video games online. Its a protocol for devices on a network to seemlessly discover each other (e.g., plug and play); e.g., you install a network printer on your local network and all your computers on your network will have another printer listed on their printing choices without you doing anything; or you can stream media from your computer on your TV/vice versa. It also should use ports 2869 (TCP) 1900 (UDP) not 5000 (old standard).
    – dr jimbob
    Feb 9, 2012 at 15:28
-1

If all you want to do is browse the web then you may close all of the ports on your router.

Open ports are only necessary to accept incoming connections. So if you want to host a webserver then you will need port 80 open, however, if all you want to do is access other peoples webservers then port 80 (and all other ports) may be safely closed.

3
  • This is not correct: under normal circumstances closing the Domain port will prevent the OP to resolve domain names and therefore completely block his Internet access. The DNS server being most probably enforced by DHCP, the OP must first take care of manually configuring his network parameters and choose an alternative DNS server. Jan 2, 2016 at 11:18
  • @WhiteWinterWolf I'm talking inbound here. Closing inbound port 53 just means they will not be able to run a DNS server
    – Andy Smith
    Jan 4, 2016 at 17:21
  • So your answer makes sense, however I highly doubt that the OP really has got these ports open on the Internet, he most probably scanned his router from the internal network, saw the traditional ports for such device being opened, and ask if he should close them (which makes sense but is impossible with most ISP provided home routers without adding some supplementary device in front of it). Jan 4, 2016 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .