1

An nmap scan (WAN side) on my Netgear R7000 router indicates that there are two ports open: 80/tcp (http) and 1720/tcp (h323q931). My method to perform a WAN side scan on the router is to access the Internet through a hotspot on my smartphone to place myself on a separate network and run nmap against the public IP address for my router's network (nmap -Pn (public IP address)).

To make matters more interesting, a GRC ShieldsUP scan indicates all ports are closed. UPnP is not enabled (i.e. the box us UNchecked) and I have not enabled port forwarding for any ports. I have rebooted the router and run the scan from separate Windows and MAC computers (connected to the separate network created through my phone's hotspot) with the same results every time i.e. 80 and 1720 are open.

And to add even more to the confusion, the router's logs do not record any attempts to scan the ports i.e. the logs category "Known DoS attacks and Port Scans" shows no entry for either the nmap or GRC scans.

Relevant particulars:

Nighthawk R7000 AC1900 Router

Firmware: V1.0.7.6_1.1.99

I would greatly appreciate any help and insight into whether there is a security vulnerability here i.e. the ports are exposed and open to exploit, or if something else is going on that leads nmap to designate these ports as "open". Also, any information on why the logs are not recording these scan attempts would also be appreciated. Thank you in advance.

  • Are you sure you're hitting the router? Depending in how you get your internet access, it's not uncommon for there to be another device between the router and the internet - a fibre modem or a cable converter, for example – Matthew Jan 7 '17 at 19:20
  • Hi Matthew, thanks very much. I do have a modem (Motorola SurfBoard SB6141) that my router is connected to. Could that be causing the response indicating open ports i.e. am I hitting the Motorola modem first, which is indicating open ports? – maap Jan 7 '17 at 22:24
  • Could well be, yes. Hard to be sure though, since there are many ways to configure them. If you're getting a banner from either port, that might narrow it down. – Matthew Jan 7 '17 at 22:26
  • Thank you. Not much on the banners; I ran some more nmap scans and the most I get back are "http?" on 80 and "h323q931?" on 1720. As far as http I am not running a webserver; I understand h323q931 is related to VOIP, which could be set by ISP? I played around with modem gui and couldn't find much as far as configuration; everything should be at default. I might try resetting the modem - any other ideas? – maap Jan 7 '17 at 23:34
  • 1
    Thanks @Matthew. Looks like it is neither the router, modem, or any devices, but is something to do with ISP (Comcast) i.e. think I am hitting ISP first, which is showing open ports for 80 and 1720. I first disconnected every device from the network, rebooted router, and hit my pub IP address with nmap (WAN side). Still open ports. Then I powered down router, waited 10 mins, tried again. Still open ports. Then I shut down modem, waited, tried again, and still got the open ports! I'm not sure how that works, but apparently I am hitting my ISP first with nmap (or something like that)? – maap Jan 10 '17 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.