To address a VoIP voice lag issue, my provider added port triggering rules for over 42,000 ports on my router, which seemed sloppy. And as I understand it, port triggering should only be able to resolve an inability to connect at all, not poor call quality once connected. But... the lag seems slightly better. So I'm weighing that possible improvement against any security risks.
Consider a triggering range of 5060-6000 as an example. As I understand it, if my VoIP client initiates a connection to my VoIP provider over port 5061:
- My router opens ports 5060-6000 for incoming traffic.
- They remain open while the VoIP session is active, and probably briefly afterward.
- During that time window, it will route all incoming traffic on those ports to my computer.
- Incoming traffic can reach my computer from any sender on those ports, not just from the server I initially triggered to.
Assuming that's right (corrections welcome), does this only create vulnerabilities if there's a service on my PC listening and responding to that incoming port? For example, if I triggered port 80 and had a web server running on my PC?
Or can an attacker somehow access my computer or the rest of the network even without a listener for that port on my PC?