Router responding on WAN TCP ports 80 and 443

[jorgsmash]

ASUS AX88U on 386.2_4 firmware
Diversion and Skynet enabled

I just ran a Nessus vulnerability scan on my public DDNS name and it found that ports 80 and 443 TCP are responding as open on the WAN interface. I don't have any web servers and I don't have port forwarding set up for those particular ports. I do not have the router GUI page set up to be accessible from the WAN. Router GUI is accessible from LAN only. I do have port forwarding enabled, but not for those ports. I set up these port forwards to attempt to get Open NAT type to my computer for gaming (Warzone, specifically). But that didn't even work anyway... still moderate NAT type.

I also have the OpenNAT settings enabled, same ports as above.

Nessus results:

The remote host is up
The remote host replied to a TCP SYN packet sent to port 80 with a SYN,ACK packet
Port 80/tcp was found to be open
Port 443/tcp was found to be open

I confirmed the results using nmap:

Host is up, received user-set (0.071s latency).
Scanned at 2021-06-02 18:10:22 EDT for 215s

PORT STATE SERVICE REASON VERSION
80/tcp open http? syn-ack
443/tcp open https? syn-ack

Why would the router be responding to requests to these two ports? I tried browsing to them via HTTP/HTTPS and got nothing.

 

[ColinTaylor]

Are you scanning from the internet? If you're scanning from a client on your LAN it's not a valid test.

 

[jorgsmash]

Are you scanning from the internet? If you're scanning from a client on your LAN it's not a valid test.

Yes. I scanned from my laptop connected to my phones hostspot via cellular network.

 

[ColinTaylor]

Try pointing a browser at those ports and see what you get.

 

[jorgsmash]

Try pointing a browser at those ports and see what you get.

Already tried. Last sentence in OP. Connection times out.

 

[ColinTaylor]

Already tried. Last sentence in OP. Connection times out.

Sorry, I missed that.

I suspect this is just a false response generated by your ISP's equipment.

You said you were also having forwarding/NAT issues. Have you confirmed that your DDNS IP address matches that shown on the router's Network Map page?

 

[jorgsmash]

Sorry, I missed that.

I suspect this is just a false response generated by your ISP's equipment.

You said you were also having forwarding/NAT issues. Have you confirmed that your DDNS IP address matches that shown on the router's Network Map page?

I have Frontier Fiber coming into the house going to an ONT device they installed. No other equipment from them. Then my ASUS AX88u. And the NAT issues are related to Call of Duty Warzone. I tried forwarding ports in the Port Forwarding tab to my PC but that didn't give me Open NAT in game. It's not a huge deal though.

 

[ColinTaylor]

It would be worth double-checking the WAN IP address anyway.

 

[jorgsmash]

It would be worth double-checking the WAN IP address anyway.

Oh yeah I double checked the IP address was correct by using nslookup on the ddns name and comparing to the IP in the router gui page.

 

[StR]

Personally, I check if a port is open from a cloud server to which I have shell access - by doing
telnet MYIP 80 or telnet MYIP 443. If there is no response at all - it means the port is closed. You can try doing that from your laptop command prompt (you can easily install telnet on a Mac. Unfortunately, Windows 10 doesn't have telnet anymore, but you can use 3rd-party utilities, e.g. cygwin or install a package from Windows: https://www.geeksforgeeks.org/how-to-run-linux-commands-on-windows-10/ - I haven't done the latter but I hope it includes telnet)

Alternatively, you can check with some other online port scanner, e.g. https://www.whatismyip.com/port-scanner/

 

[archiel]

If you are talking about a telnet client, then it is still there in Windows 10 Pro, just go to Control Panel > Programs and Features > Turn Windows features on or off

 

[StR]

Aah, yes, thank you, I missed that.
Personally I am using MobaXterm which has bash and telnet built in. (And have cygwin on some computers.)

 

[ColinTaylor]

I'm seeing same: open port 443 on AX86U w/Merlin 386.2_6 - my ISP is Comcast.

I think your situation is different than the OP because:

However I do have OVPN Server setup to use 443 TCP port with a DDNS address. I do not have any port forwarding setup and the router firewall is on by default.

I ran a port scan using GRC's ShieldsUp for common ports which detected 443 as open for "http protocol over TLS/SSL".

In the OP's case nmap didn't detect what service (if any) was running on that port and just returned "https? syn-ack". Similarly GRC always returns "http protocol over TLS/SSL" for 443 regardless of the state of the port.

@jorgsmash can confirm whether anything on his router is listening on those ports with the following command:

netstat -nlp | grep -E ":80|:443"

He can also check what ports have been opened by UPnP by going to System Log > Port Forwarding.

 

[Chuckles67]

I think your situation is different than the OP because:

In the OP's case nmap didn't detect what service (if any) was running on that port and just returned "https? syn-ack".

Agreed. I confirmed it's my OVPN Server settings that cause port 443 to be open. Thus I deleted my post as it's off-topic.

Thanks - interesting post.