1

Today I was playing around with Nmap on Ubuntu Linux. I performed a port scan on our home router with nmap -sV 192.168.1.1 The results were as follows:

**Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-18 12:08 SAST
Nmap scan report for homerouter.cpe (192.168.1.1)
Host is up (0.0029s latency).
Not shown: 992 closed ports
PORT     STATE    SERVICE         VERSION
22/tcp   open     tcpwrapped
23/tcp   filtered telnet
53/tcp   open     domain
80/tcp   open     http            Huawei E5172 router http admin
443/tcp  open     ssl/http        Huawei E5172 router http admin
631/tcp  filtered ipp
3000/tcp open     ppp?
8081/tcp filtered blackice-icecap
Service Info: Device: broadband router; CPE: cpe:/h:huawei:e5172

There were more ports open than I expected. For example, I can understand why port 80 and 22 were open by default. But why were ports 23, 53, 631, and 3000 open?

Should these be open? Are these ports a security risk to be left open, or are these ports needed for essential services? And if so, what are these essential services?

  • Several of those say 'filtered' which actually means nmap can't determine, but when you are scanning from the same network segment 'filtered' almost always means NOT open. On some routers the 'inside' web interface (80 and 443) although indeed essential is vulnerable to CSRF attacks, but I don't know (and don't know how to check) for your specific model. 53 is DNS; unless you can implement DNSSEC or at least DNScrypt, DNS has risks regardless of which server you use (your router or some other). – dave_thompson_085 Sep 18 '16 at 13:51
  • I can't find any specific security issues with the Huawei E5172 though Huawei certainly had problems a few years ago. – Julian Knight Sep 18 '16 at 18:59
2
  • 23 - for TELNET connections (remote shell, insecure)
  • 22 - for SSH connections (remote shell, secure)
  • 53 - DNS lookups
  • 3000 - PPP is a method for connecting to the WAN
  • 631 - IP printing
  • 80, 443 - are the standard admin web interface. 443 is for HTTPS, 80 for HTTP
  • 8081 - This one is slightly harder. It would generally be used for a web service of some kind. It is also possible that another device on your network has opened this via UPnP.

So yes, all of those are valid for the internal port of a router.

Every open port does, of course, carry some risk and it is better to close any you don't actually need but that is dependent on the router actually allowing you to. The moral here is that most consumer routers are terrible for security! Not only do they leave ports open that aren't needed (purely to make things simple to configure) but they rarely get firmware updates to keep them secure.

Ideally, you would want to close ports 23, 80, 631 (if you aren't doing printing via the router). 3000 may not be needed but you would have to test that. However, it is unlikely that the router provides a method to do this.

If you want better security, go for a router that allows replacement firmware in the form of OpenWRT or for a make that understands security such as the EdgeRouter Lite from Ubiquity. They may not be quite as convenient to configure (though even that is certainly up for debate) but the get far more updates and generally get any issues dealt with quickly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.