0

I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?

$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:34 EDT
Nmap scan report for 192.168.1.1
Host is up (0.0030s latency).
Not shown: 989 filtered ports
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
548/tcp   open  afp
631/tcp   open  ipp
5000/tcp  open  upnp
8200/tcp  open  trivnet1
9100/tcp  open  jetdirect
9101/tcp  open  jetdirect
9102/tcp  open  jetdirect
9103/tcp  open  jetdirect
20005/tcp open  btx

Nmap done: 1 IP address (1 host up) scanned in 17.04 seconds
1

The router has (at least) two interfaces. Your nmap 192.168.1.1 scans against the internal interface and lists the services the router is providing for your LAN (DNS, web interface for administration etc.). That's a different set of services than the services it's providing for the wild Internet on the WAN interface. Scan from the Internet should only list the services you have planned to expose; possibly none on a home gateway.

You can log into your router (http://192.168.1.1) and browse the web admin interface to disable all the services you don't need. E.g. if you don't use HP JetDirect, it's a good practice to disable it even if there's no current vulnerabilities involved. On the other hand, Universal Plug and Play (UPnP) can be used to open inbound ports, exposing your LAN devices to the Internet, and can be consider as a threat.


Port by port with a little help from NETGEAR R6400v2 User Manual. (Usually I wouldn't dig this deep for a single product I don't own, but the arrogant attitude on the NETGEAR Community made me.)

  • 53/tcp (domain). There's no option to turn DNS service of, and it is required as the DHCP server on the router always introduces itself as the resolver.
  • 80/tcp (http). Used for network administration and can't be closed.
    • Also used for file sharing from USB drive and enabled by default; I'd recommend disabling it (from ADVANCED > USB Functions > ReadySHARE Storage).
  • 548/tcp (afp). Apple Filing Protocol is related to file sharing; disabling ReadySHARE might affect.
  • 631/tcp (ipp). Mac OS X Printer Sharing. (Same explanation as for 9100-9103/tcp.)
  • 5000/tcp (upnp). Like explained, this should be disabled (ADVANCED > Advanced Setup > UPnP).
  • 8200/tcp (trivnet1). This isn't Trivnet. It's MiniDLNA Media Derver (Chapter 8, p. 94).
  • 9100-9103/tcp (jetdirect). NetGear calls this ReadySHARE Printer Utility (Chapter 9). It's controlled with an external utility. Not sure if could be disabled.
  • Dont see in my login interface these ports that nmap are showing open it shows empty. – john_zombie Mar 18 at 0:48
  • Model: Netgear R6400v2 – john_zombie Mar 18 at 0:49
  • I did just turn off upnp – john_zombie Mar 18 at 0:49
0

Just because ports are open doesn't mean it's a bad thing.

Ports themselves are not vulnerable, it's the services that are listening on them ports that have possible vulnerabilities.

However, accessing your router will allow you to implement permissions on ports/port-forwarding etc.

  • The weird thing is I dont have a jetdirect printer.. If im not using them why not close those ports? – john_zombie Mar 17 at 0:58
  • I dont see an option on my router to close those ports thats whats weird. – john_zombie Mar 17 at 0:58
  • HP printer on your network perhaps? - Jetdirect is the technology that enables HP printers to work on networks. – Tipping44 Mar 17 at 10:25
  • If you have a network printer, as opposed to a USB connected printer, it almost certainly supports JetDirect. It's no longer just HP. – user10216038 Mar 17 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.