Disabling Firewall Opens up Remote Access

[securitybyte]

Hi

I am running Asuswrt-Merlin 378.56_2 on a RT-N66U.

Today I was having trouble getting port forwarding working, so I disabled the firewall temporarily to see if that made any difference.

Then by luck, I realised my router interface had opened up to the world :\

I double checked my settings, verified remote access was disabled, uPnP was disabled, etc etc.

Finally, upon re-enabling the firewall, my router was hidden from the Internet again.

Is this right?! - Surely the remote access option should not be overridden by disabling firewall.


Port scan details below:

Starting Nmap 6.00 ( http://nmap.org ) at 2015-12-05 20:59 EET
Initiating Ping Scan at 20:59
Scanning xxxxxxxxxx [4 ports]
Completed Ping Scan at 20:59, 0.04s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 20:59
Scanning xxxxxxxxxx [100 ports]
Discovered open port 80/tcp on xxxxxxxxxx
Discovered open port 9100/tcp on xxxxxxxxxx
Discovered open port 515/tcp on xxxxxxxxxx
Completed SYN Stealth Scan at 20:59, 0.13s elapsed (100 total ports)

[+] Nmap scan report for xxxxxxxxxx
Host is up (0.027s latency).
Not shown: 97 closed ports

PORT STATE SERVICE
80/tcp open http
515/tcp open printer
9100/tcp open jetdirect



Many thanks

Edit. I guess it does say 'When your network's firewall is disabled and you set 80 as the HTTP server's port range for your WAN setup, then your http server/web server would be in conflict with RT-N66U's web user interface'... but still

Edit 2. Maybe a standard Asus firmware thing rather than Merlin, sorry

 

[martinr]

How did you run your nmap scan? Was it genuinely from outside your network with no wifi (or other) connection to your internal network?

If you disable your firewall would it not make sense that Port 80 (at least) is visible from the WAN: the firewall is no longer there dropping all unsolicited requests from the WAN.

 

[RMerlin]

If you disable the firewall, then EVERYTHING running on your router becomes enabled over the WAN. No firewall means just that: nothing is blocked at all.

 

[securitybyte]

Thanks Martin and Merlin
Yeh I guess that does make sense thinking about it.. Just caught me by surprise at the time