Is leaving a web server port open on my router a security compromise?

Question

I was wondering if I were to open port 80 on my router and forwards it to port 80 on my Apache web server would create a security compromise to the rest of my network. I was reading that open ports are not compromising until there is a service running on the port(such as Apache). However my question remains,can a hacker do much with a web server. Can the web server be hacked and create other security flaws in my network?

Answer 1

Your Apache server could still get compromised and the hacker can expand access to the rest of the network from it by pivoting or tunneling traffic, so it does create security risks. Depending on how (what vulnerability was exploited and how) the Apache server was compromised, the hacker can do a wide range of things from catastrophic to minor.

But this is all assuming there is a service (Apache or other) running and listening on a certain port exposed to the Internet. If you set up forwarding but there are no services running on that port on a machine, there is nothing to compromise except perhaps DoS.

If you NEED to open the port 80 to public, then there are various techniques to mitigate some risks like using DMZ, using an uncommon custom port, running proxies, etc.

Answer 2

Whether or not it's a compromise depends on what service is running behind the port. Is that web service intended to be publicly accessible? If No, then it's a compromise. If Yes, then Does the service run an up to date software with no known vulnerabilities? If Yes, then it's a compromise. Only you can decide whether something is a risk for you.

Answer 3

Forwarding external connections to some service inside the internal network is not a security compromise by itself but it could result in one. While the port forwarding will only give access to the specific service from outside it is not uncommon that the a web application (which is now available from outside) can be hacked and that the attacker thus gets access to the system where the application is running on. And sometimes its not even a problem of the web application but that the web server itself allows remote code execution already.

If the attacker has compromised the system of the web server this way it can now do even worse: Since this compromised system is on the internal network the attacker can use it as starting point to compromise the rest of the network.

Thus if you want to expose servers to the internet you should never forward external connections to the inside but instead put the server into a DMZ, i.e. a separate network which has limited visibility from the internet but can not access the internal network. This way the web server itself might still be compromised but it gets much harder to extend a successful attack into the internal network.