1

I've been trying to up my security recently and decided to check my router's firewall by doing an nmap scan (wan). I'm surprised by home many ports it found:

Host is up (0.032s latency).
Not shown: 986 closed ports
PORT      STATE    SERVICE
22/tcp    filtered ssh
23/tcp    filtered telnet
53/tcp    open     domain
80/tcp    open     http
443/tcp   open     https
705/tcp   open     agentx
1026/tcp  open     LSA-or-nterm
1027/tcp  open     IIS
1028/tcp  open     unknown
1029/tcp  open     ms-lsa
2601/tcp  open     zebra
49152/tcp open     unknown
49153/tcp open     unknown
49154/tcp open     unknown

I don't think my router is doing a great job of closing unneeded ports. I think having ports 22,23,53,80,443 open is ok, since those are all necessary things, but I don't see what the rest are used for. Which ones should I close?

Here's an example for 1026: http://www.speedguide.net/port.php?port=1026

A lot of them seem to be associated with Trojans, actually. I have a firewall set up on my main linux machine, but there are other windows computers connected that I'm not in direct control of.

Edit: So maybe a better question is to ask what these ports are for and what they likely are open for.

Improve this question
5
  • "having ports 22,23,53,80,443 open is ok, since those are all necessary things" - No one except you knows what are your necessary things. For you having an open telnet port on the WAN interface might be necessary, for others it might be blatantly ridiculous.
    – techraf
    Dec 6, 2016 at 1:01
  • Maybe I'm not quite understanding what ports do. I was under the impression that in order to use those features (http/s, telnet, DNS etc.) The corresponding ports had to be open. Right? I guess I should have said "anybody browsing the internet", but I thought it was clear from the context that in bit running a web server or anything.
    – Astrum
    Dec 6, 2016 at 1:24
  • "I thought it was clear from the context that in bit running a web server or anything." - it's not clear what you mean even from your own words. Please read what your device produces and correct it. Communicate clearly and do not rely on context too much.
    – techraf
    Dec 6, 2016 at 1:33
  • None of the programs I use seem to use these ports, but I can't speak for the other computers on the router. I could try closing them and seeing if anybody complains that something isn't working.
    – Astrum
    Dec 6, 2016 at 2:30
  • I think techraf is trying to tell you that we cannot know what ports are reasonable. For example, telnet should be avoided everywhere (unencrypted) but it is common for it to be open on the internal interface of a router. To know more, we would need to understand what router you have and the source/destination addresses that are using the ports (if any).
    – Julian Knight
    Dec 6, 2016 at 8:35

2 Answers 2

Reset to default
1

If you really did check the WAN side of your router and found these open, you have a real problem.

If that is really the case, I recommend disconnecting it and doing a factory reset and upgrade of the firmware.

In particular, the TELNET port should NEVER be open since that is allowing unencrypted login and access to a machine, maybe even your router.

I rather suspect though that you checked the LAN side not the WAN side.

Improve this answer
4
  • Hm, well what I actually did was test it directly from the terminal. I later checked using a remote website and got two different results. When I did the standard test (without -Pn), it refused a connection, when I did it with -Pn it came back with only one port open (7547/tcp). which I've blocked off through port-forwarding. I'm not sure why there's a discrepancy.
    – Astrum
    Dec 7, 2016 at 6:04
  • "the terminal" - where, outside your network? inside? If inside, you absolutely should expect different results to checking from outside (e.g. using a remote website). That's what the router/firewall combo does.
    – Julian Knight
    Dec 7, 2016 at 7:05
  • Yes, I ran the command nmap -Pn [my IP adress] from my computer, which was connected to the network.
    – Astrum
    Dec 7, 2016 at 8:53
  • 1
    Right. So you need to think about the 2 sides of your router as different cities connected by a bridge. Different networks connected by the router. This means that you should indeed see different open ports on both sides. Some of those such as TELNET are because the port is actually serviced by the LAN side of the router itself. That's why it's no good just looking at a set of ports, you also need to look at the originating and ending IP addresses as well.
    – Julian Knight
    Dec 7, 2016 at 10:40
0

As others said, you have a big problem if it is correct that you scanned the router from outside your local LAN. But as others, I also suspect that you did it from your LAN.

I am assuming you are talking about a router for a usual home network.

  • For the WAN side, I think all of those ports you mention should be closed. Of course 22, 23, 53, 80, 443 are likely NOT necessary (especially 23!). If you don't really really need to access your router externally (i.e. from a friend's house for example), then they should be closed. In a normal home router your family use to connect to the Internet, they have to be definitely closed.
  • For the LAN side, most likely: 22, 23 and 80 are NOT necessary. You probably want to keep 53 open (although not strictly necessary) as well as 443 to access the Web interface of the router (you can use 80 instead, but 443 has its security advantages). To be honest I would just try to login to your router via Web and see what you can configure to shut down services and applications that are opening such ports. You might not need most of them.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .