Server ports open (not wanted) AC-68u Merlin 380.68_4

[Butterfly Bones]

Asus AC-68U with Merlin 380.68_4. I've run Whats My IP port scanner and Shields UP port scan. I'm getting that these ports are open - 53 DNS - 80 HTTP - 443 HTTPS - 1723 VPN [PPTP]

I've gone through all settings and all tabs on WAN, LAN, Tools, Administration, VPN, Firewall and nothing is open, particularly Enable Web access from WAN. I do use a VPN client set to Policy Rules Strict and DNS Exclusive. I have Skynet. Entware, and AB-Solution on a USB drive. Samba is off in USB Application - Network Place (Samba) Share / Cloud Disk as are all tabs in USB application tabs.

I last ran these tests over a 6-8 weeks ago and nothing was open. The only changes recently are adding three Google Home devices and lights. Would those devices open the ports?

I've searched SNB and the web and find nothing that seems appropriate. I know one cannot shutdown everything, but I've seen and increase in bot scans from around 100 to 5-600 / hour in the last two days. Is paranoid justified or silly?

 

[popxunga]

Asus AC-68U with Merlin 380.68_4. I've run Whats My IP port scanner and Shields UP port scan. I'm getting that these ports are open - 53 DNS - 80 HTTP - 443 HTTPS - 1723 VPN [PPTP]

I've gone through all settings and all tabs on WAN, LAN, Tools, Administration, VPN, Firewall and nothing is open, particularly Enable Web access from WAN. I do use a VPN client set to Policy Rules Strict and DNS Exclusive. I have Skynet. Entware, and AB-Solution on a USB drive. Samba is off in USB Application - Network Place (Samba) Share / Cloud Disk as are all tabs in USB application tabs.

I last ran these tests over a 6-8 weeks ago and nothing was open. The only changes recently are adding three Google Home devices and lights. Would those devices open the ports?

I've searched SNB and the web and find nothing that seems appropriate. I know one cannot shutdown everything, but I've seen and increase in bot scans from around 100 to 5-600 / hour in the last two days. Is paranoid justified or silly?

Port 53 is probably the DNS server on your router and should not be exposed. Ports 80 and 443 should not be exposed/open, unless you have a webserver at home serving via http or https and in these cases, it is necessary to define a port forwarding/virtual server rule.
What's the output of netstat -ntlp executed in your router via ssh ?
You may wanna try disable UPNP in your router.

 

[john9527]

Turn off your VPN client and re-run the test. When you run with the VPN client active, you are testing the VPN server you are connected to, not the router.

 

[popxunga]

Turn off your VPN client and re-run the test. When you run with the VPN client active, you are testing the VPN server you are connected to, not the router.

If he is running the test from outside his network, how would the VPN client being active/inactive affect the test result ?

Edit: No need to answer... I got it ! I was thinking in a VPN server...

 

[Butterfly Bones]

Port 53 is probably the DNS server on your router and should not be exposed. Ports 80 and 443 should not be exposed/open, unless you have a webserver at home serving via http or https and in these cases, it is necessary to define a port forwarding/virtual server rule.
What's the output of netstat -ntlp executed in your router via ssh ?
You may wanna try disable UPNP in your router.

Thank you for the reply. Yes I understand the ports and know they should not be open, I have no web server. UPnP is disable. -p is invalid argument for netstat on my router.

netstat: invalid option -- p
BusyBox v1.25.1 (2017-10-04 15:01:12 EDT) multi-call binary.

Usage: netstat [-ral] [-tuwx] [-enW]

# netstat -ntl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:5473            0.0.0.0:*               LISTEN    
tcp        0      0 0.0.0.0:18017           0.0.0.0:*               LISTEN    
tcp        0      0 0.0.0.0:3394            0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:515         0.0.0.0:*               LISTEN    
tcp        0      0 127.0.0.1:139           0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:139         0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:9100        0.0.0.0:*               LISTEN    
tcp        0      0 0.0.0.0:9998            0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.2:80          0.0.0.0:*               LISTEN    
tcp        0      0 127.0.0.1:80            0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:80          0.0.0.0:*               LISTEN    
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:53          0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:22          0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.2:443         0.0.0.0:*               LISTEN    
tcp        0      0 127.0.0.1:8443          0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:8443        0.0.0.0:*               LISTEN    
tcp        0      0 127.0.0.1:445           0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:445         0.0.0.0:*               LISTEN    
tcp        0      0 192.168.1.1:3838        0.0.0.0:*               LISTEN

 

[Butterfly Bones]

Turn off your VPN client and re-run the test. When you run with the VPN client active, you are testing the VPN server you are connected to, not the router.

That is exactly what happened! Thank you for explaining and decreasing my paranoia. With the VPN off all ports time out. Big lesson today, one of many on SNB.

I have two VPN providers and when one gets flaky I switch to the other until it gets flaky. I guess I have never run the port scan test (inside the LAN always) with this VPN.