Port 443 showing as open?

[Namdrino]

I have an ASUS RT-AC5300 router running the latest stable version of Asuswrt-Merlin (384.5). When I perform an external nmap scan on my IP address, it shows the following:

443/tcp open ssl/http mini_httpd 1.19/bhoc 23sep2004

Remote administration is disabled, UPnP disabled, everything I can think of that could cause this is disabled (No VPN server, SSH disabled, etc.). I have no port forwarding configured for this port either.

Has anyone had a similar issue or know how I can close this port? From my limited research, the mini_httpd is built into Asuswrt-Merlin but not sure what uses it..... any help is appreciated!

 

[skeal]

I have an ASUS RT-AC5300 router running the latest stable version of Asuswrt-Merlin (384.5). When I perform an external nmap scan on my IP address, it shows the following:

443/tcp open ssl/http mini_httpd 1.19/bhoc 23sep2004

Remote administration is disabled, UPnP disabled, everything I can think of that could cause this is disabled (No VPN server, SSH disabled, etc.). I have no port forwarding configured for this port either.

Has anyone had a similar issue or know how I can close this port? From my limited research, the mini_httpd is built into Asuswrt-Merlin but not sure what uses it..... any help is appreciated!

Do you use ab-solution with pixelserv-tls? It is a server and uses that port.

 

[kfp]

That’s the Asus router web UI/server. They based it on mini_httpd.

Edit: what @skeal said makes much more sense

Do you actually use 443 for it though? Isn’t the default usually 8443?

Can’t you just use a different IP (VPN or LTE would work) and check what’s being served on that port?

 

[ColinTaylor]

From my limited research, the mini_httpd is built into Asuswrt-Merlin but not sure what uses it..... any help is appreciated!

It might be different for the RT-AC5300 but I don't believe Asus uses mini_httpd. I think they use lighttpd instead.

This suggests it might be a cable/DVR box.

 

[Namdrino]

If I try to connect to the port via a browser the connection is refused.

 

[Namdrino]

It might be different for the RT-AC5300 but I don't believe Asus uses mini_httpd. I think they use lighttpd instead.

This suggests it might be a cable/DVR box.

Very interesting.... this might be it as I do have a UVerse router/modem in front of the router. Thanks I will take a look!

 

[kfp]

It might be different for the RT-AC5300 but I don't believe Asus uses mini_httpd. I think they use lighttpd instead.

Nah, lighttpd is there for webdav stuff. Web UI for Asuswrt (and DD-WRT and Tomato) are derived from mini_httpd.

 

[ColinTaylor]

Nah, lighttpd is there for webdav stuff. Web UI for Asuswrt (and DD-WRT and Tomato) are derived from mini_httpd.

Yes you're correct. Asus uses (and nmap identifies) milli_httpd so I still think the OP is detecting a different device.

 

[kfp]

milli_httpd is derived from mini_httpd
https://github.com/RMerl/asuswrt-me...df74/release/src/router/httpd/httpd.c#L17-L21

The fastest way IMO is just doing a curl -X GET <public ip:443> from wherever @Namdrino did the nmap scan, and see what comes back.

 

[Odkrys]

443 is default port of aicloud.