What's new

Router responding on WAN TCP ports 80 and 443

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

jorgsmash

Senior Member
ASUS AX88U on 386.2_4 firmware
Diversion and Skynet enabled

I just ran a Nessus vulnerability scan on my public DDNS name and it found that ports 80 and 443 TCP are responding as open on the WAN interface. I don't have any web servers and I don't have port forwarding set up for those particular ports. I do not have the router GUI page set up to be accessible from the WAN. Router GUI is accessible from LAN only. I do have port forwarding enabled, but not for those ports. I set up these port forwards to attempt to get Open NAT type to my computer for gaming (Warzone, specifically). But that didn't even work anyway... still moderate NAT type.

1622673515994.png


I also have the OpenNAT settings enabled, same ports as above.

1622673915553.png



Nessus results:

The remote host is up
The remote host replied to a TCP SYN packet sent to port 80 with a SYN,ACK packet
Port 80/tcp was found to be open
Port 443/tcp was found to be open

I confirmed the results using nmap:

Host is up, received user-set (0.071s latency).
Scanned at 2021-06-02 18:10:22 EDT for 215s

PORT STATE SERVICE REASON VERSION
80/tcp open http? syn-ack
443/tcp open https? syn-ack

Why would the router be responding to requests to these two ports? I tried browsing to them via HTTP/HTTPS and got nothing.
 
Are you scanning from the internet? If you're scanning from a client on your LAN it's not a valid test.
 
Are you scanning from the internet? If you're scanning from a client on your LAN it's not a valid test.
Yes. I scanned from my laptop connected to my phones hostspot via cellular network.
 
Already tried. Last sentence in OP. Connection times out.
Sorry, I missed that.

I suspect this is just a false response generated by your ISP's equipment.

You said you were also having forwarding/NAT issues. Have you confirmed that your DDNS IP address matches that shown on the router's Network Map page?
 
Sorry, I missed that.

I suspect this is just a false response generated by your ISP's equipment.

You said you were also having forwarding/NAT issues. Have you confirmed that your DDNS IP address matches that shown on the router's Network Map page?

I have Frontier Fiber coming into the house going to an ONT device they installed. No other equipment from them. Then my ASUS AX88u. And the NAT issues are related to Call of Duty Warzone. I tried forwarding ports in the Port Forwarding tab to my PC but that didn't give me Open NAT in game. It's not a huge deal though.
 
It would be worth double-checking the WAN IP address anyway.
Oh yeah I double checked the IP address was correct by using nslookup on the ddns name and comparing to the IP in the router gui page.
 
Personally, I check if a port is open from a cloud server to which I have shell access - by doing
telnet MYIP 80 or telnet MYIP 443. If there is no response at all - it means the port is closed. You can try doing that from your laptop command prompt (you can easily install telnet on a Mac. Unfortunately, Windows 10 doesn't have telnet anymore, but you can use 3rd-party utilities, e.g. cygwin or install a package from Windows: https://www.geeksforgeeks.org/how-to-run-linux-commands-on-windows-10/ - I haven't done the latter but I hope it includes telnet)

Alternatively, you can check with some other online port scanner, e.g. https://www.whatismyip.com/port-scanner/
 
If you are talking about a telnet client, then it is still there in Windows 10 Pro, just go to Control Panel > Programs and Features > Turn Windows features on or off

1622823793065.png
 
Aah, yes, thank you, I missed that.
Personally I am using MobaXterm which has bash and telnet built in. (And have cygwin on some computers.)
 
I'm seeing same: open port 443 on AX86U w/Merlin 386.2_6 - my ISP is Comcast.
I think your situation is different than the OP because:
However I do have OVPN Server setup to use 443 TCP port with a DDNS address. I do not have any port forwarding setup and the router firewall is on by default.

I ran a port scan using GRC's ShieldsUp for common ports which detected 443 as open for "http protocol over TLS/SSL".
In the OP's case nmap didn't detect what service (if any) was running on that port and just returned "https? syn-ack". Similarly GRC always returns "http protocol over TLS/SSL" for 443 regardless of the state of the port.

@jorgsmash can confirm whether anything on his router is listening on those ports with the following command:
Code:
netstat -nlp | grep -E ":80|:443"

He can also check what ports have been opened by UPnP by going to System Log > Port Forwarding.
 
Last edited:
I think your situation is different than the OP because:

In the OP's case nmap didn't detect what service (if any) was running on that port and just returned "https? syn-ack".
Agreed. I confirmed it's my OVPN Server settings that cause port 443 to be open. Thus I deleted my post as it's off-topic.

Thanks - interesting post.
 

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top