I've been trying to up my security recently and decided to check my router's firewall by doing an nmap scan (wan). I'm surprised by home many ports it found:
Host is up (0.032s latency). Not shown: 986 closed ports PORT STATE SERVICE 22/tcp filtered ssh 23/tcp filtered telnet 53/tcp open domain 80/tcp open http 443/tcp open https 705/tcp open agentx 1026/tcp open LSA-or-nterm 1027/tcp open IIS 1028/tcp open unknown 1029/tcp open ms-lsa 2601/tcp open zebra 49152/tcp open unknown 49153/tcp open unknown 49154/tcp open unknown
I don't think my router is doing a great job of closing unneeded ports. I think having ports 22,23,53,80,443 open is ok, since those are all necessary things, but I don't see what the rest are used for. Which ones should I close?
Here's an example for 1026: http://www.speedguide.net/port.php?port=1026
A lot of them seem to be associated with Trojans, actually. I have a firewall set up on my main linux machine, but there are other windows computers connected that I'm not in direct control of.
Edit: So maybe a better question is to ask what these ports are for and what they likely are open for.