Port forwarding and port blocking security concerns

Question

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests me a lot is securing of router ports from outside. As it was thoroughly explained here, blocked/filtered port is better than just port having no services bind to it, 'cause blocked port doesn't send response to attacker.

However, what if the port is not blocked , but not forwarded anywhere on router level? Is it equivalent to blocking in sense of security?

In my understanding, unforwarded port is just simply redirected to nowhere, and attacker just cannot use it to compromise anything. Does this makes any sense?

UPDATE: Added reference links for @ISMSDEV and others who don't believe that ransomware and RDP are following in toe.
1. Ransomware and RDP – Are you vulnerable?
2. Ransomware spreads through weak remote desktop credentials
3. Ransomware using Remote Desktop to spread itself

Answer 1

Let me make a few assumptions to try to simplify this:

1. You're talking about a home or SOHO network, and not an enterprise environment.
2. Your router performs Network Address Translation (NAT), hence the need for port forwarding.
3. You're interested in explicitly blocked traffic vs a lack of forwarding.

So let's compare what happens in each case. For the case where you have explicitly told your router to drop incoming traffic on port 3389:

1. A TCP SYN packet comes in with destination IP set to your router and destination port 3389.
2. Your router consults pf/iptables/whatever vxworks uses and determines the packet should be dropped.
3. The packet is dropped, the router forgets about it, and no response is sent to the attacker.

For the case where you just have nothing forwarded:

1. A TCP SYN packet comes in with destination IP set to your router and destination port 3389.
2. Your router consults pf/iptables/whatever and finds no explicit direction to handle it. (Including no port forwarding!)
3. Your router consults its network state table, finds no matching connection (either established or "related"), so the packet does not need to be forwarded on via NAT.
4. Your router checks for a listening service on port 3389 itself.
5. Since 2/3/4 struck out, the router has no idea what this packet is supposed to do, so it sends a connection reset (TCP RST) back to the requesting host.

In either case, no TCP connection is actually established. Some people believe that dropping packets is better because it "hides your presence" online. I guess that's potentially true, but then you need to drop on every port and have no port forwarding. Otherwise, it's clear to an attacker that your IP is alive. Furthermore, most SOHO users should be most concerned about opportunistic attacks rather than targeted -- in that case, attackers will just be scanning large blocks of IPs looking for port 3389 open. Dropping a packet or resetting makes little difference to this attacker.

Answer 2

So, if you forward a port that has no legitimate service running on the backend of your network, then I would not be too concerned about it. However, I would not have open ports on my networking unless they are necessary either.

As for the RDP, 3389 should never be directly exposed to the internet. Even an obfuscated port# for RDP should never have direct internet access via port forwarding or any other means.

If you're concerned about RDP security, make sure you have a well configured VPN with RSA 4096 or ECDSA encryption set-up.