Understanding a Zenmap output

Question

I'm running Zenmap on my Windows 7 laptop. I ran an intense scan with UDP targeting my router 192.168.1.1.
I realize that I'm probing into the back end of the router from the inside and that any open ports are nothing to be concerned about.
At the time, my iPod (on standby/not turned on) and my laptop were the only connected devices.

In the left-hand window under HOSTS (OS / Host) I have two entries:

1. host 2-96--.as13285.net(2.96.*.""") - (I've hidden some numbers as *)
2. 192.168.0.1

With host 2-96.... highlighted, and the Ports/Hosts tab in the right window selected, I see 21,22,23,443 all filtered and 80, 631 (IPP) open.

However, if instead I now highlight 192.168.1.1, I see two more services listed, both UDP, and both open: 53 and 1900 (UPnP)

My questions are:

1. Given that my external IP address (2-96-*-*) and 192.168.1.1 are exactly the same device (the router), why do I see 2 extra services (granted they are UDP) if I look at the 192.168.1.1 scan?

2. I envisage the NAT and firewall systems as sitting in the middle of the router, between the front end and the back end.
   And thinking that the back end of my router is waiting to receive any traffic from any possible port inside my network, I would not have been surprised if the scan had said all 65000 ports are open or at least listening/filtered (I know that "listening" is not a state NMAP recognises).
   So what's so special about the 6/8 ports/services that are detected and why aren't all 65000 found in one way or another?

Answer 1

This is all to be expected.

A router with multiple interfaces can have services listen on just some interfaces.

You're right conceptually that NAT sits between the two interfaces, but normal outbound NAT does not create open ports.

Sit back and chill out :-)