Open ports on my NetGear router

Question

I ran an nmap scan on my home router and I am seeing a ton of open ports. Is this normal? How do I go about closing them?

$ nmap 192.168.1.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-16 20:34 EDT
Nmap scan report for 192.168.1.1
Host is up (0.0030s latency).
Not shown: 989 filtered ports
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
548/tcp   open  afp
631/tcp   open  ipp
5000/tcp  open  upnp
8200/tcp  open  trivnet1
9100/tcp  open  jetdirect
9101/tcp  open  jetdirect
9102/tcp  open  jetdirect
9103/tcp  open  jetdirect
20005/tcp open  btx

Nmap done: 1 IP address (1 host up) scanned in 17.04 seconds

Answer 1

The router has (at least) two interfaces. Your nmap 192.168.1.1 scans against the internal interface and lists the services the router is providing for your LAN (DNS, web interface for administration etc.). That's a different set of services than the services it's providing for the wild Internet on the WAN interface. Scan from the Internet should only list the services you have planned to expose; possibly none on a home gateway.

You can log into your router (http://192.168.1.1) and browse the web admin interface to disable all the services you don't need. E.g. if you don't use HP JetDirect, it's a good practice to disable it even if there's no current vulnerabilities involved. On the other hand, Universal Plug and Play (UPnP) can be used to open inbound ports, exposing your LAN devices to the Internet, and can be consider as a threat.

---

Port by port with a little help from NETGEAR R6400v2 User Manual. (Usually I wouldn't dig this deep for a single product I don't own, but the arrogant attitude on the NETGEAR Community made me.)

• 53/tcp (domain). There's no option to turn DNS service of, and it is required as the DHCP server on the router always introduces itself as the resolver.
• 80/tcp (http). Used for network administration and can't be closed.
  • Also used for file sharing from USB drive and enabled by default; I'd recommend disabling it (from ADVANCED > USB Functions > ReadySHARE Storage).
• 548/tcp (afp). Apple Filing Protocol is related to file sharing; disabling ReadySHARE might affect.
• 631/tcp (ipp). Mac OS X Printer Sharing. (Same explanation as for 9100-9103/tcp.)
• 5000/tcp (upnp). Like explained, this should be disabled (ADVANCED > Advanced Setup > UPnP).
• 8200/tcp (trivnet1). This isn't Trivnet. It's MiniDLNA Media Derver (Chapter 8, p. 94).
• 9100-9103/tcp (jetdirect). NetGear calls this ReadySHARE Printer Utility (Chapter 9). It's controlled with an external utility. Not sure if could be disabled.

Answer 2

Just because ports are open doesn't mean it's a bad thing.

Ports themselves are not vulnerable, it's the services that are listening on them ports that have possible vulnerabilities.

However, accessing your router will allow you to implement permissions on ports/port-forwarding etc.