Hello,
I have two x86_64 routers based on which I have installed keepalived and mwan3.
Today I configured postfix to receive emails if the ISP or one router fails.
At telnet on port 25 it turned out that the master router responds. When scanning with nmap, I saw that other ports were open.
With ncat I opened any port that is not defined for external access. When trying to telnet to this port, the router responds.
Do you have upnp installed and enabled? If so, that may be the reason you're seeing additional ports open
How are you testing? nmap from inside or outside the network? If you test your WAN IP from a cellular connection or another location entirely, do you still see the same ports open?
Did you make any changes to the firewall or port forwarding?
please post the contents of /etc/config/firewall (be sure to paste it into the </> code block).
Do you have upnp installed and enabled? If so, that may be the reason you're seeing additional ports open
I checked and I don't have upnp installed
How are you testing? nmap from inside or outside the network? If you test your WAN IP from a cellular connection or another location entirely, do you still see the same ports open?
I did the nmap tests on a server outside my network. That's how I realized I had open ports.
Did you make any changes to the firewall or port forwarding?
Yes, I have opened and redirected several ports.
For test I stopped ports 22 and 80.
As 22 was redirected to IP in my internal network, and 80 to web administration.
Port 25 is not defined.
All three ports are visible from the outside of my network. Also port 53
please post the contents of /etc/config/firewall
cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option drop_invalid '1'
option synflood_protect '1'
option custom_chains '1'
option synflood_burst '50'
option tcp_ecn '1'
option tcp_syncookies '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'netx'
list network 'net1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option target 'ACCEPT'
list proto 'tcp'
option name '443'
option src 'wan'
option dest_port '443'
config rule
option name '32400'
option src 'wan'
option target 'ACCEPT'
config rule
option dest_port '22'
option src 'wan'
option name 'EnableSSH'
option target 'ACCEPT'
list proto 'tcp'
option enabled '0'
config rule
option dest_port '80'
option src 'wan'
option name '80'
option target 'ACCEPT'
list proto 'tcp'
option enabled '0'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
option enabled '0'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
option enabled '0'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
option enabled '0'
config include
option path '/etc/firewall.user'
config redirect
option dest_port '21'
option src 'wan'
option name 'ftp 2121 -> ftp 21'
option src_dport '2121'
option target 'DNAT'
option dest_ip '192.168.198.21'
option dest 'lan'
list proto 'tcp'
config redirect
option dest_port '3389'
option src 'wan'
option name 'RDC Win10'
option src_dport '3389'
option target 'DNAT'
option dest_ip '192.168.198.30'
option dest 'lan'
list proto 'tcp'
config redirect
option target 'DNAT'
option name 'plex'
list proto 'tcp'
option src 'wan'
option src_dport '32400'
option dest 'lan'
option dest_ip '192.168.198.21'
option dest_port '32400'
config redirect
option dest_port '49125-65534'
option src 'wan'
option name 'ftp:49125-65534'
option src_dport '49125-65534'
option target 'DNAT'
option dest_ip '192.168.198.21'
option dest 'lan'
list proto 'tcp'
option enabled '0'
config redirect
option target 'DNAT'
option name 'node_pi'
list proto 'tcp'
option src 'wan'
option src_dport '31400-31409'
option dest 'lan'
option dest_ip '192.168.198.30'
option dest_port '31400-31409'
option enabled '0'
config redirect
option dest_port '22'
option src 'wan'
option name 'ssh'
option src_dport '22'
option target 'DNAT'
option dest_ip '192.168.198.32'
option dest 'lan'
list proto 'tcp'
option enabled '0'
You have a TON of ports being forwarded to 192.168.192.21 (49125-65534). This is not directly the cause of your issue, but doesn't look right at all. No services should ever require 16K ports forwarded. And it is possible that your NAT layer is running out of ports causing the other (normally reserved) ports to be used for normal network functionality. (although this rule does appear to be disabled, but don't re-enable that one)
What is upstream of your router? Try unplugging the router and then running the same test. Sometimes the upstream device (modem/ONT, or modem+router) has some ports open.
Both routers are virtual.
My network has the following configuration.
ISP1 and ISP 2 are connected to the manage switch.
The vlan reaches two Hipervisors and so on to the routers.
A third vlan returns traffic to my network.
I do tests with nmap on both ISPs. I get a real IP address from both ISPs.
Since your routers are virtual, have you been able to 100% confirm that the response is not coming from the host itself? You could shut down the OpenWrt VMs and then repeat your test. If you still see the issue, it is either your host or could be something on the switch. Next step would be to disconnect the host from the switch and run the test again.
Hello,
After stopping both routers there was no ping next to them. In nmap, to make sure that IP addresses are not picked up elsewhere, nmap reports that there are no live hosts.
The problem is in openwrt, but I don't understand where. I can close the ports manually, but this is not a solution. One router (Master) was configured 1 week ago (I updated).
Hello,
If I understand correctly,
it's about the fact that there are 2 lines in iptables, but there are none in the config.
I usually use the web interface to configure rules. There I noted tcp and udp, but today after restarting the firewall I noticed that there is an error that they do not exist.
This is a problem I thought I would solve later
Regards,
Hello
I understand, but the configuration file is generated by the system, not manually.
And I have no idea why it is generated this way, given that I have chosen TCP and UDP ports.
I temporarily closed the ports like this:
iptables -I zone_wan_input -p tcp -m tcp --dport 25 -j reject
It's already midnight for me and I will continue to investigate.
I've been looking for what's wrong for 7 hours now.